TinyPortal

I posted this on SMF, but thought I'd post here as well in case anyone has experienced this.
______________________________

Someone is trying to do a hack on my site as I type this.  Some of the errors I see are:

: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'msg108613' at line 11
/forum/Sources/Load.php
579

and

this is the partial error.  I don't want to post full thing here to give anyone any ideas.  But the strange thing is I can't see their IP addresses.

Hacking attempt...

SELECT
c.ID_CAT, b.name AS bname, b.description, b.numTopics, b.memberGroups,
b.ID_PARENT, c.name AS cname, IFNULL(mem.ID_MEMBER, 0) AS ID_MODERATOR,
mem.realName, b.ID_BOARD, b.childLevel,

Hopefully, someone can advise me before they are successful in breakin in   :o

Anything I could do to further protect my site?  I put the site in maintanance mode right now thinking it might slow them down.   :o

I have never seen a hacking attempt giving those errors.
Are you sure you havent installed or removed any mod from your site. ?

I got a similar thing after i have removed the Coppermine gallery and forgot to remove the cpg files from SMF and index.php

Also, in your online list, or error log, dont you see who is doing what and where, you should be able to see if some one have tried to login as admin or moderator and failed.
Check your error log

Quote from: G6â„¢ on March 02, 2007, 07:26:38 AM
I have never seen a hacking attempt giving those errors.
Are you sure you havent installed or removed any mod from your site. ?

I got a similar thing after i have removed the Coppermine gallery and forgot to remove the cpg files from SMF and index.php

Also, in your online list, or error log, dont you see who is doing what and where, you should be able to see if some one have tried to login as admin or moderator and failed.
Check your error log

I recently upgraded my Arcaded and installed a new shoutbox, but after further review they didn't see like a thread and could possibly have been a new type of spider.

I could not see what they were doing on the Online list or log.  They had no IP address or description other than 'Guest'.

Contact your host ASAP, so that they can look into catching this guy in the act.

Quote from: IchBinâ„¢ on March 02, 2007, 03:56:35 PM
Contact your host ASAP, so that they can look into catching this guy in the act.

I will thanks!   ;)

If in fact, it is a hacking attempt. I should have clarified that I don't know whether it is or not. :)

Well, one of my forums during usage today gave me this message: "Got error 127 from storage engine"

I cannot get my index page to load at all now.

At first, it was telling me that my database was not 1.1.2, so I needed to upgrade to avoid this problem. Issue I have with that is that I upgraded a LONG time ago, and until today, the database didn't have an issue with anything... ;)

So, I dunno. I think someone has figured out an exploit. I only suspect this, not because my forum and portal don't function, but because a site I have nothing to do with admining is refusing to allow me to log in... and I could a few hours ago.

Quote from: IchBinâ„¢ on March 02, 2007, 04:43:43 PM
If in fact, it is a hacking attempt. I should have clarified that I don't know whether it is or not. :)

they haven't been back since last night so we'll see.

Quote from: Frost on March 02, 2007, 05:25:56 PM
Well, one of my forums during usage today gave me this message: "Got error 127 from storage engine"

I cannot get my index page to load at all now.

At first, it was telling me that my database was not 1.1.2, so I needed to upgrade to avoid this problem. Issue I have with that is that I upgraded a LONG time ago, and until today, the database didn't have an issue with anything... ;)

So, I dunno. I think someone has figured out an exploit. I only suspect this, not because my forum and portal don't function, but because a site I have nothing to do with admining is refusing to allow me to log in... and I could a few hours ago.

Last time I got that error I when into myphpadmin and did a repair of the database.  that fixed it.

It sounds like a database problem with your host to me.

Yeah, doing further investigation, it appears that someone is exploiting a hole somewhere else to skirt through all the databases, mine included. I've advised my admins to change their passwords immediately (somehow, the board order got switched...only permissible for two folks...unless they messed with the mySQL tables directly.) I was also informed of a database error recorded by SMF, in addition to the previous message and a confirmation by other members that the site had indeed gone down hard for a few hours.