Please Help! Hack by BeyazKurt - Bey4zKurt@Gmail.Com

Discussion in 'Security' started by bading, Apr 4, 2008.

0
  1. #1
    Guys please help, i don't know why my Joomla site can hacked by this BeyazKurt. He is adding his own article and setting this as my frontpage. What will i do to prevent this. Thanks.
     
    bading, Apr 4, 2008 IP
  2. Joomla Dude

    Joomla Dude Banned

    Messages:
    592
    Likes Received:
    11
    Best Answers:
    0
    Trophy Points:
    0
    #2
    Hey bro,its really a serious issue.
    I can surely help you in this regard and prevent your site from beoing hacked again by any stupid fellow.

    Add me up in any of the Ims,which you prefer and then we can discuss.
    Dont worry,i will help you to the fullest.
    Thanks..
     
    Joomla Dude, Apr 5, 2008 IP
  3. SSANZ

    SSANZ Peon

    Messages:
    861
    Likes Received:
    10
    Best Answers:
    0
    Trophy Points:
    0
    #3
    RFI or MySQL injection?
     
    SSANZ, Apr 6, 2008 IP
  4. bading

    bading Peon

    Messages:
    62
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #4
    I think its MYSQL injection, because at first he injected on the top of the frontpage news. Then, he created his own news and added to the news items.

    Below is the exact message:


    0wn By BeyazKurt - - F@CK ALL "SEX" SITES!
    Pikaçu bi çarp şunlarıda porn neymiş anlasın saygısızlar!


    After that message there is image of Picachu (Pokemon) cartoon character.

    My site is not a sex site, its just an online magazine. By the way, my hosting is on Godaddy.com.


    Thanks
     
    bading, Apr 6, 2008 IP
  5. uski

    uski Peon

    Messages:
    94
    Likes Received:
    6
    Best Answers:
    0
    Trophy Points:
    0
    #5
    If you are using a CMS (Content Management System) you probably got hacked through a known vulnerability. This happen (it always happen) if you do not use the latest version.

    If you made the website yourself, be sure to escape all the user inputs before sending them to the SQL queries. For example, in PHP, you can use mysql_real_escape_string.

    The number one rule is to always, always update the web applications you are using once a new version is available. Or you WILL get hacked. And if you are developping an application yourself, be sure to know what you are doing.

    If you provide us with more info I can try to help you.

    By the way... this is my first post here. Hi everyone.
     
    uski, Apr 16, 2008 IP
  6. mrki

    mrki Active Member

    Messages:
    206
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    53
    #6
    Password Reset Forgery exploit for joomla, all 1.5.x installs prior to and including 1.5.5 are affected.
    To fix this add this code:



    if(strlen($token) != 32) {
	$this->setError(JText::_('INVALID_TOKEN'));
	return false;
}
    PHP:

    after line 113: 
    global $mainframe
    PHP:
    of /components/com_user/models/reset.php
     
    mrki, Aug 18, 2008 IP