Zenphoto
The simpler media website CMS
ZenphotoThe simpler media website CMS
Forum search only. You might also want to search on the main site's user guide.
Your support helps pay for this server, and helps development of zenphoto. Thank you!
Visit the donations page
Comments
It would be interessting to know what exactly happend in case it concerns Zenphoto (which must not be the case).
ErrorDocument 400 http://network....
ErrorDocument 401 http://network...
ErrorDocument 403 http://network...
ErrorDocument 404 http://network...
ErrorDocument 500 http://network...
------------
ADMINISTRATOR NOTE: Code example editied because it seems to alert virus scanners
92.63.104.34 - - [08/Nov/2011:19:49:50 +0100] "POST /zp-core/zp-extensions/tiny_mce/plugins/ajaxfilemanager/inc/class.images.php?truecss=1 HTTP/1.1" 200 53 "-" "User-Agent: Mozilla/5.0 (Windows; u; Windows nt 5.1; en-us; rv:1.9.1.5) gecko/20091102 firefox/3.5.5 gtb5"
It was an old problem detected in tinymce File Ajax manager, it seems that the hacker has the ability to upload desired files on the server and also replace .htaccess files in order to redirect to some malware site. I have deleted this plugin because i have no use of it but update tinymce or zenphoto should be a good alternative. Also check the last modified date of your files, you will easily find out the concerned files.
The uploaded file was a file called class.images.php and index.php, the last one is empty but the class file contain this code :
`
// here the date of the hack
`
------------
ADMINISTRATOR NOTE: Code example editied because it seems to alert virus scanners.
First, the search that web page suggests is pretty useless. Too many legitimate results to sift through.
Second, If I do manage to browse to the filemanager script I can get it to load the page, but it is locked into the "uploaded" folder and anyway I could not get an upload to actually work.
Maybe you can warn your users to avoid further damages.
I also had an attack on some of my websites working on an old release of ZP (I know I should update them).
I fixed ajax_create_folder.php refering to http://www.zenphoto.org/trac/ticket/2005
Then I've deleted ajaxfilemanager/inc/class.images.php and removed the content of ajaxfilemanager/inc/data.php
The script was creating .htaccess in my folders trying to redirect to some russian adresses.
Check if a bot called "MaMa CaSpEr" crawled you site.
@peacepostman : what did you change in ajaxfilemanager.php ?
Recently a lot of these security reports flooded twitter (these sites tend to copy from each other anyway) and they all address 1.4.1.4. Of course if anyone finds other potential security issues feel free to let us know via the forum, bugtracker or even for security reasons via our contact form.
If any file has been replace it might be a good idea to check permissions and the server configuration. If that is too loose Zenphoto is not even involved. Also inform your host about it as it is also possible that someone got into the server itself (happen a few weeks ago to a quite big German hoster).
We had the same problem and had to reupload all php files
I worried about what the hack actually did.
It injected this code to all our php zen files.
global $sessdt_o; if(!.... }
------------
ADMINISTRATOR NOTE: Code example editied because it seems to alert virus scanners
I held off updating because I lost all my descriptions last time I updated.
If you lost descriptions on an upgrade you did something wrong, sorry to say that. If you keep the zp-data folder and its config file intact (e.g. the same database credentials) nothing will be lost. Also a good idea is to use the database backup tool before upgrading so you always can revert.
There is an url and if I google that it seems that is some film related site. Either this is a very bad and illegal way of selfpromotion or they have been expoited as well.
Are you able to determine what the cookie name might be. All that is gibberish to me
I'd like to find it and delete.
I have updated my installation to 1.4.1.5(8326) (from 1.4.1.4), disabled tiny_mce and deleted its folder in /zenphoto/zp-core/zp-extensions. Hopefully that will shut the door on any other attacks.
Interestingly following this thread I checked my cookies and found several with a .ru domain name extension! Logging out of Firefox and back in they had all disappeared (I have the option set to accept all cookies but delete them when I log off).
One other query if I may: I have Sitewatch (sitewat.ch) enabled on my site and it has flagged an XSS vulnerability on /zenphoto/page/search/ using the input:
</sCrIpT><sCrIpT>alert(123)</sCrIpT>
It comes up as no matches found, of course, but is it something about which I should worry?
Mowgli
Anyway, Search parameters are sanitized when retrieved and html encoded when displayed so that code fails to execute.
[edit] Well, at least standard themes do the html encoding. I cannot guarantee that third party thems do the same. If not there could be a vulnerability.
I had to purge image cache, then pre-catch images.
The attack also places .htaccess files in all my root folders. You should check if the same happened to you.
Below is what was in the .htaccess file.
--------------------
ErrorDocument 400 http://large... ErrorDocument 401 http://large... ErrorDocument 403 http://large... ErrorDocument 404 http://largep.... ErrorDocument 500 http://large... <IfModule mod_rewrite.c> RewriteEngine On RewriteCond %{HTTP_REFERER} .*google.* [OR] RewriteCond %{HTTP_REFERER} .*ask.* [OR] RewriteCond %{HTTP_REFERER} .*yahoo.* [OR] RewriteCond %{HTTP_REFERER} .*baidu.* [OR] RewriteCond %{HTTP_REFERER} .*youtube.* [OR] RewriteCond %{HTTP_REFERER} .*wikipedia.* [OR] RewriteCond %{HTTP_REFERER} .*qq.* [OR] RewriteCond %{HTTP_REFERER} .*excite.* [OR] RewriteCond %{HTTP_REFERER} .*altavista.* [OR] RewriteCond %{HTTP_REFERER} .*msn.* [OR] RewriteCond %{HTTP_REFERER} .*netscape.* [OR] RewriteCond %{HTTP_REFERER} .*aol.* [OR] RewriteCond %{HTTP_REFERER} .*hotbot.* [OR] RewriteCond %{HTTP_REFERER} .*goto.* [OR] RewriteCond %{HTTP_REFERER} .*infoseek.* [OR] RewriteCond %{HTTP_REFERER} .*mamma.* [OR] RewriteCond %{HTTP_REFERER} .*alltheweb.* [OR] RewriteCond %{HTTP_REFERER} .*lycos.* [OR] RewriteCond %{HTTP_REFERER} .*search.* [OR] RewriteCond %{HTTP_REFERER} .*metacrawler.* [OR] RewriteCond %{HTTP_REFERER} .*bing.* [OR] RewriteCond %{HTTP_REFERER} .*dogpile.* [OR] RewriteCond %{HTTP_REFERER} .*facebook.* [OR] RewriteCond %{HTTP_REFERER} .*twitter.* [OR] RewriteCond %{HTTP_REFERER} .*blog.* [OR] RewriteCond %{HTTP_REFERER} .*live.* [OR] RewriteCond %{HTTP_REFERER} .*myspace.* [OR] RewriteCond %{HTTP_REFERER} .*mail.* [OR] RewriteCond %{HTTP_REFERER} .*yandex.* [OR] RewriteCond %{HTTP_REFERER} .*rambler.* [OR] RewriteCond %{HTTP_REFERER} .*ya.* [OR] RewriteCond %{HTTP_REFERER} .*aport.* [OR] RewriteCond %{HTTP_REFERER} .*linkedin.* [OR] RewriteCond %{HTTP_REFERER} .*flickr.* RewriteRule ^(.*)$ http://large... [R=301,L] </IfModule>
------------
ADMINISTRATOR NOTE: Code example editied because it seems to alert virus scanners
I don't have any idea what to do next...
I changed the theme from one to another.
Still got this redirect from:
http://www.cxc.info/
to:
http://network-teaser.ru/getup/index.php
Then copy the new release files (1.4.1.5) in full (except albums and cache) over to your server.
The reason for deleting ALL the zenphoto files at your remote site is because spurious files have been added to several folders by the hack so a simple "overwrite" in FTP, for example, won't get rid of these (again I learned this the hard way!)
You'll have to re-configure zp-data/zp-config.php (or copy it from a known clean source).
If you have a local theme, delete all of those files and copy them from a known good source. If you haven't got a clean copy of the files then check them all for the code noted above which may have been injected unto them:
`
global $sessdt_o; if(!$s....;} }
`
This was added to ALL the .php files in my theme - just after the initial <?php line.
So far that seems to have cleared everything that I can find but I await with trepidation for the appearance of something else.
Hope this helps.
Mowgli
------------
ADMINISTRATOR NOTE: Code example editied because it seems to alert virus scanners
html files seems to be corrupted too :
I found this code at the end in some of them :
`
try{...
`
no idea about the damage that this code could done
could you give an advice :
should I modify all the login/password : ftp ? sql ? zenphoto ?
------------
ADMINISTRATOR NOTE: Code example editied because it seems to alert virus scanners
If I am reading the injected js right it is trying to steal sessions/cookies. Make sure to remove cookies/sessions from your browser and logout/login on the webapp if you have navigated to an injected site with your browser!