Waraxe IT Security Portal

neodesc · Regular user

The other day I found one of the websites I often visit without any news whatsoever in their db and it's a news site with thousands of them lol

The site: http://tinyurl.com/mcozb

They just restored a backup.

It happened to me a few years ago when I was still running phpnuke.

How did they do it?

waraxe · Site admin

Somebody probably got admin access and then just erased all news. There is lot's of security holes in phpnuke older versions. And most of the third-party modules are not securely written. When attacker succeeds in finding sql injection or LFI/RFI hole, then admin account compromise may be possible.

neodesc · Regular user

Thank you for answering so fast Janek.

When someone did this exactly same thing to me they didn't get admin access.

Besides he has that thing on his admin http://tinyurl.com/66gbu3

And they would have done something else like placing links or whatever.

I'm pretty sure they didn't get access to the admin panel. There must be something else.... but if you don't know how to do it I guess it can't be done Razz

waraxe · Site admin

There are infinite count of ways to accomplish some goal. If attacker has found one or couple of security holes, then escalation can be possible. Basic auth can't stop this. For example, if there is local file disclosure bug, then attacker can read .htaccess and .htpasswd and then try to crack stolen auth hash.
By the way, there is publicly exposed phpmyadmin interface:

http://www.********.com/phpmyadmin

It is protected with basic auth too, but still this is another possible attack vector.
And - without seeing webserver logs there is no way to figure out, how attack has been done. We can just guess and speculate ...