Member
I have v1.2.9 on a client's site. In troubleshooting connectivity problem today, I see that the config file has been edited to reflect a different database name, user name and password and mysql_host redefined to point to mysqlforfree.com instead of the local host.
Using the user name and password, I logged in at mysqlforfree.com to see what was there. No database there, but there was an actual account set up.
Has this ever happened in the past? Is this a known vulnerability of the old version? What would a hacker accomplish by doing this? In other words, I am trying to find out if just editing the config file back to the correct settings will fix the gallery, or was there further damage done?
Any light shed on the situation would be helpful. Thanks.
Using the user name and password, I logged in at mysqlforfree.com to see what was there. No database there, but there was an actual account set up.
Has this ever happened in the past? Is this a known vulnerability of the old version? What would a hacker accomplish by doing this? In other words, I am trying to find out if just editing the config file back to the correct settings will fix the gallery, or was there further damage done?
Any light shed on the situation would be helpful. Thanks.
Administrator
Member
Actually, probably the most common reason this happens is that you have not removed the setup files from your installation. Current versions of Zenphoto will recommend you do this. There are really a lot of security issues in such an old Zenphoto. Please beware.
This hack does not give the hacker access to your site, just breaks it. Restoring the zp-config.php file will most likely make everything right again. But, do remove the setup files and consider upgrading for the other security improvements.
This hack does not give the hacker access to your site, just breaks it. Restoring the zp-config.php file will most likely make everything right again. But, do remove the setup files and consider upgrading for the other security improvements.
Member
Member
Member
All setup files should be deleted just to be safe. (None are useful anyway unless all are there.) But to be sure delete the setup.php as it is the most dangerous.
Unless you have serious server security issues as well, the hacker could not place the setup files back on your server. Besides, if he could do this, he could just replace the zp-config.php file alone, so why would he bother with the setup files
Unless you have serious server security issues as well, the hacker could not place the setup files back on your server. Besides, if he could do this, he could just replace the zp-config.php file alone, so why would he bother with the setup files