Advanced search  

News:

cpg1.5.48 Security release - upgrade mandatory!
The Coppermine development team is releasing a security update for Coppermine in order to counter a recently discovered vulnerability. It is important that all users who run version cpg1.5.46 or older update to this latest version as soon as possible.
[more]

Pages: [1]   Go Down

Author Topic: [Joomla wrapper] SEVERLY HACKED EVEN WITH 1.4.4!!!!!!! SEVERLY PISSED!  (Read 7130 times)

0 Members and 1 Guest are viewing this topic.

Grendel

  • Coppermine newbie
  • Offline Offline
  • Posts: 7
[Joomla wrapper] SEVERLY HACKED EVEN WITH 1.4.4!!!!!!! SEVERLY PISSED!
« on: March 22, 2006, 04:53:52 am »
Ok guys... I believe I am getting remote hacked.  I checked my user logs regularly and found direct linking into the gallery on my site that basically gives a hacker major access...

PLEASE ADVISE!... I know you do not like having info posted on the board but I do not know how else to contact the appropriate people.  Here is a sample link... I have removed user info from my site and left it open so you may investigate... everything is backed up...


I use Joomla 1.0.8  Coppermine 1.4.4 and CoppermineVis 1.3.0

This sucks and would appreciate any type of immediate action.
« Last Edit: March 31, 2006, 03:36:04 am by Grendel »
Logged

Grendel

  • Coppermine newbie
  • Offline Offline
  • Posts: 7
SEVERLY HACKED EVEN WITH 1.4.4!!!!!!! SEVERLY PISSED! Cross Post but need help
« Reply #1 on: March 22, 2006, 04:56:31 am »
Ok guys... I believe I am getting remote hacked.  I checked my user logs regularly and found direct linking into the gallery on my site that basically gives a hacker major access...

PLEASE ADVISE!... I know you do not like having info posted on the board but I do not know how else to contact the appropriate people.  Here is a sample link... I have removed user info from my site and left it open so you may investigate... everything is backed up...


I use Joomla 1.0.8  Coppermine 1.4.4 and CoppermineVis 1.3.0
« Last Edit: March 31, 2006, 03:36:21 am by Grendel »
Logged

kegobeer

  • Dev Team member
  • Coppermine addict
  • ****
  • Offline Offline
  • Gender: Male
  • Posts: 4637
  • Beer - it does a body good!
    • The Kazebeer Family Website
Re: SEVERLY HACKED EVEN WITH 1.4.4!!!!!!! SEVERLY PISSED!
« Reply #2 on: March 22, 2006, 05:02:54 am »
Looks like a problem with the Joomla wrapper and not Coppermine.  If you disable the Joomla wrapper, does this attack work?  I'm guessing it won't.
Logged
Do not send me a private message unless I ask for one.  Make your post public so everyone can benefit.

There are no stupid questions
But there are a LOT of inquisitive idiots

kegobeer

  • Dev Team member
  • Coppermine addict
  • ****
  • Offline Offline
  • Gender: Male
  • Posts: 4637
  • Beer - it does a body good!
    • The Kazebeer Family Website
Re: SEVERLY HACKED EVEN WITH 1.4.4!!!!!!! SEVERLY PISSED!
« Reply #3 on: March 22, 2006, 05:05:42 am »
You've also removed the Coppermine tag line.  Please replace it immediately.
Logged
Do not send me a private message unless I ask for one.  Make your post public so everyone can benefit.

There are no stupid questions
But there are a LOT of inquisitive idiots

Grendel

  • Coppermine newbie
  • Offline Offline
  • Posts: 7
Re: SEVERLY HACKED EVEN WITH 1.4.4!!!!!!! SEVERLY PISSED!
« Reply #4 on: March 22, 2006, 05:14:26 am »
Actually it was part of a purchased module from http://www.joombla.com/  it has a configuration option to remove it and states it is legal to do so... Talk with that guy. Coppermine is not sold there... but the integration with Joomla is.
Logged

kegobeer

  • Dev Team member
  • Coppermine addict
  • ****
  • Offline Offline
  • Gender: Male
  • Posts: 4637
  • Beer - it does a body good!
    • The Kazebeer Family Website
Re: SEVERLY HACKED EVEN WITH 1.4.4!!!!!!! SEVERLY PISSED!
« Reply #5 on: March 22, 2006, 05:17:18 am »
You need to address this potential hack to the author of the Joomla wrapper.  It looks like he/she did not do any sanitizing of request variables.
Logged
Do not send me a private message unless I ask for one.  Make your post public so everyone can benefit.

There are no stupid questions
But there are a LOT of inquisitive idiots

Grendel

  • Coppermine newbie
  • Offline Offline
  • Posts: 7
Re: [Joomla wrapper] SEVERLY HACKED EVEN WITH 1.4.4!!!!!!! SEVERLY PISSED!
« Reply #6 on: March 22, 2006, 05:19:48 am »
Wish I knew more about programming... what a pain in the butt!.... Thank you for such a quick response... You rule!
Logged

Joachim Müller

  • Dev Team member
  • Coppermine addict
  • ****
  • Offline Offline
  • Gender: Male
  • Posts: 47843
  • aka "GauGau"
    • gaugau.de
Re: [Joomla wrapper] SEVERLY HACKED EVEN WITH 1.4.4!!!!!!! SEVERLY PISSED!
« Reply #7 on: March 22, 2006, 07:20:18 am »
we're aware that he tells people it's legal to remove the "Powered by Coppermine" footer. It is not. He doesn't have the power to allow you to do that. We have already contacted the guy. We do not recommend CoppermineVis.
Logged

Tranz

  • Dev Team member
  • Coppermine addict
  • ****
  • Country: 00
  • Offline Offline
  • Gender: Female
  • Posts: 6149
Re: [Joomla wrapper] SEVERLY HACKED EVEN WITH 1.4.4!!!!!!! SEVERLY PISSED!
« Reply #8 on: March 23, 2006, 05:23:36 am »
So should the thread be invalid?
Logged

Joachim Müller

  • Dev Team member
  • Coppermine addict
  • ****
  • Offline Offline
  • Gender: Male
  • Posts: 47843
  • aka "GauGau"
    • gaugau.de
Re: [Joomla wrapper] SEVERLY HACKED EVEN WITH 1.4.4!!!!!!! SEVERLY PISSED!
« Reply #9 on: March 23, 2006, 09:37:45 am »
@Thu: yes, marking accordingly.

@Grendel: don't shout at us (your thread subject actually blames us of having released vulnerable code) - your thread is trying to make it look as if your site got hacked because of coppermine flaws. Although there have been flaws in coppermine in the past (and there probably will be in the future, as we're only human - we will probably make coding mistakes), the issues you're having and the reason for your site getting hacked are not related to coppermine, but using another third party app that the Coppermine team clearly disapproves. Shouting "thief" or "bug" actually means smacking us in the face. I suggest you keep your cool in the future...
Logged

Grendel

  • Coppermine newbie
  • Offline Offline
  • Posts: 7
Re: [Joomla wrapper] SEVERLY HACKED EVEN WITH 1.4.4!!!!!!! SEVERLY PISSED!
« Reply #10 on: March 23, 2006, 08:20:10 pm »
Quote from: GauGau on March 23, 2006, 09:37:45 am
@Thu: yes, marking accordingly.

@Grendel: don't shout at us (your thread subject actually blames us of having released vulnerable code) - your thread is trying to make it look as if your site got hacked because of coppermine flaws. Although there have been flaws in coppermine in the past (and there probably will be in the future, as we're only human - we will probably make coding mistakes), the issues you're having and the reason for your site getting hacked are not related to coppermine, but using another third party app that the Coppermine team clearly disapproves. Shouting "thief" or "bug" actually means smacking us in the face. I suggest you keep your cool in the future...

Sorry if it seemed so... thing is... the site was hacked and there was an immediate need to find out why.  Shouting is a way of getting attention to the matter in as fast of time as possible... The problem was unknown... it could have been your code (even though in this case it was not) and people should have a right to know that something is up... once identified as to who the culprit was.... then you will see that I give credit when it was due...

I appreciate your guys passion... maybe it is a cultural difference... but do not be too sensitive. Remember you are reading written word... Meaning can be interpreted many different ways.
Logged
Pages: [1]   Go Up
« previous next »
 

Page created in 0.021 seconds with 15 queries.