SQL Injection

Yours is a V6 site.



I think the lesson here is back up your DB and files regularly.

Moving thread to V6 section...

Now, what V6 version are you running?
What 3rd party infusions do you have?

HI, sorry about posting wrong..

im using php-fusion v6.01.15

i have:
The Kroax video infusion
Avatar resizer


i have done some rechearch, and found that the problem maybe is in the infusion "The Kroax"
and im doing some checking on that, and have just upgraded to the new version from them that was released a few days ago i think. and i have asked them if this is fixed in the new version and awaiting reply on that, but they are aware of the problem now.

it's never a good feeling when someone has had access to your site and to your database.. :(
now i have no idea if they have put a backdoor in or whatever... :(

so be careful out there fellow fusion users, be safe, backup and upgrade!

and help eachother! :)

Best wishes for a great weekend. :)

Daraiko
www.Daraiko.dk

og and here is a link to some info i found on the problem ;)

http://www.securityfocus.com/bid/29976

Yes, there's a fix in the most current news item and the fix is inlcuded in the newest release as well. Anyone using kroax should upgrade asap.

Oh, and if you want quicklink to the patch, here it is.
http://www.venue.nu/patch/kroax.zip

Thank you very much :)

i have upgraded to Kroax RC2 and updated it with the link you sent me to be safe ;)

Does anyone know if there is an infusion to check the database for backdoors?? :)

Sorry (actually not) to break it to you, but there is no such thing as a backdoor in a database. A backdoor is a way to "re-hack" the site. If you upgrade to v7 or replace all PHPFusion files, there is no way for a backdoor to be maintained. The most that they could do with database access is to change your (a.k.a. admin) password, or another admin's password (if there is another admin), or create a new user and make that user an admin. Just check for any admins (or other positions of power) that you did not assign/did not previously know about.

But there could be any bad code in the database, too.
Remember that you can execute PHP-Code in Panels and Custom pages ;)

ok :)

thank you very very much ;)
i have not upgraded to v7 yet, but thinking about it, it looks soo good, i have installed it on another of my domain ( www.junglebajer.dk ) to try it out ;)

and i love the tighter security on it too and more setings ;)

im loving what i see, just need to see if my infusion and things work aswell ;)

GREAT WORK GUYS !! :)

That was great thanks for letting us know, it came handy.

V7 looks good but im also waiting for themes and few other infusions to be upgraded such as the better banners by method man, the index forum, moderator...kroax is cool.

is this for real?
i have never heard of antivirus for php??

have anyone any idea of this?

Is it me or are you constantly posting useless crap anywere...

ignas2526 hereby banned for double posting and also passing out links with outdated software with hundreds of popups. We don't want that.