forum.coppermine-gallery.net

No Support => General discussion (no support!) => Topic started by: Zaitzev on May 05, 2006, 11:14:50 pm

Title: A complete list of all files in CPG?
Post by: Zaitzev on May 05, 2006, 11:14:50 pm

Hi.

Out of curiousity and concern, I wonder what files are included in the CPG-distros? That is, what files except the ones in the zip archive are being created upon installation, modification or user input (This does not mean the images they upload..).

The reason I ask, is because of a recent attempt to make my gallery site kneel to the ground with some lame attacks, using uploaded php-files etc. Yes, I have a "public uploads" folder where everyone can upload images, which needs admin-moderation to be published. However, someone has uploaded a bunch of archive-files AND a few other files, "exploiting" CPG and the rest of the site.

This came to my attention when my ISP contacted me regarding this issue. They also closed down my site temporary due to these "attacks".
I browsed every single folder in my gallery-structure, where I found a bunch of malicious files under the /albums/userpics catalog (zip, php etc). I deleted those and the corresponding folders. In the /userpics/ directory, there is a file named .httpd - I am not sure if this is an include in the gallery or if it's a "bad file". Anyone?

I will be relieved when I can rest assure that I know the complete file structure of the CPG..

Thanks in advance!

Title: Re: A complete list of all files in CPG?
Post by: Nibbler on May 05, 2006, 11:19:15 pm

Download Coppermine and take a look at the included files. The files install.lock and config.inc.php are created after installation. Take a look at any suspicious files with a text editor and make backups before you delete anything. .httpd is not a part of Coppermine.