Site Hacked

@dch3Feb 03.2011 — #Not that familiar with security, but from what I've read, I'd guess that the permissions on the folder need to be looked at. I'd search around and google terms like 'web server security' for best practices.

@DasherFeb 03.2011 — #If the $_GET variable is used to get a file, it can also get an external file which can then obtain access to your server. I had a problem like that once, and my solution was to only allow file names that were listed in an array.

@Jarrod1937Feb 03.2011 — #Its probably too late now, but the best thing you can do when this sort of thing happens is download all of the raw access logs you can get your hands on for a post mortem analysis.

The best thing to do though is to develop filtering functions for $_GET, $_POST and $_COOKIE values. You can walk through each as an array and filter each item with a general filter function (will any of your variables need - or _ or `...etc), and can even then use the array's associative index key as an identification for specific variables that require specifc filtering (is the field alphanumeric only), though this method depends on your code style preference.

Then you should go to each variable individually and apply the filtering at their level too (if $_GET['page'] is passed to $page. then $page=myFilterFunction($_GET['page']); ). This is a multi-layered approach and helps make sure no user vars are unfiltered.

The filtering should be a whitelist approach if at all possible. This means that instead of saying "This character is bad... and so is this one... and this one...etc", you're actually saying "only this set of characters are good, and all others are bad", this is a far more robust methodology. The more restrictive you make your whitelist filters the better. You can also cast the variable values to specific datatypes before use:

$_GET['page']='999';

$page=(int)$_GET['page'];

Which forces the variable to be an int.

If the variable is for a file of some sort, make sure you limit what it can grab. Again, a whitelist method is best. Create an array or a switch statement with the allowed files, and if the variable matches none, have it select a default file.

And lastly, use mysql_real_escape_string(); which will properly escape variables before they're used in a database query.

As mentioned, you may also need to check your directory and file permissions, make sure they only have the permissions they need to operate and no more.

I could give information on how they were able to upload files... but considering you (probably) don't have raw access logs, and have not shown any code, i would be completely guessing. Without the logs, it is possible they utilized more than one attack vector, but we wouldn't know it (like a server vulnerability for example).

Site Hacked

3 Comments(s) _↴

Also in #PHP _↴

Success!

Social

Version

Site Hacked

3 Comments(s) ↴

Also in #PHP ↴

Success!

The web is an endless sea of information. Don't miss the boat... Subscribe!

Social

Version

3 Comments(s) _↴

Also in #PHP _↴