I hate PHP & SQL!

[Toby]

You are certain that a hole in your recipe script is the access point for the hacker?

My TGP script templates were hacked last month, but the initial access point was via a hole in my traffic trade script.

[Nymph]

Originally Posted by Toby

You are certain that a hole in your recipe script is the access point for the hacker?

My TGP script templates were hacked last month, but the initial access point was via a hole in my traffic trade script.

Yeah pretty sure, they injected a string into my categories. I did a search, and this hack has been found before, but no fix for it, and they didn't give a lot of details.

and I don't want to hear about the tgp hack, I just got TGPX yesterday to set up

[Toby]

Originally Posted by Nymph

Yeah pretty sure, they injected a string into my categories. I did a search, and this hack has been found before, but no fix for it, and they didn't give a lot of details.

and I don't want to hear about the tgp hack, I just got TGPX yesterday to set up

Actually, of the five domains I have on that box running TGP scripts, the one using TGPX was the only one untouched, even though I was running the same trade script on all of them.

No fix for a known security hole is bad news. They just put bots to work looking for installs of that script to exploit. I hope you can find another script for the job that will allow you to import your existing data.

[Nymph]

Originally Posted by Toby

Actually, of the five domains I have on that box running TGP scripts, the one using TGPX was the only one untouched, even though I was running the same trade script on all of them.

No fix for a known security hole is bad news. They just put bots to work looking for installs of that script to exploit. I hope you can find another script for the job that will allow you to import your existing data.

That's good news, I'd hate to think I just put out money for a another headache

The last hack was a new one too, but my server dude did the sql fix, and patched the script for me.

Right now I'm going crosseyed looking at different scripts...I might just end up doing a WP install, and reworking the whole site, although I'd really like to stay away from PHP & SQL...that combo still has that "bad taste in mouth" for me.

[Jace]

Nymph, hit me up on pm, got something for you

[Jace]

haha it would help if I had PM's turned on

they are on now, hit me up if you want a huge database for that recipe site

[Hell Puppy]

A few basic security thoughts...

--make sure any input field processing protects against sql injection. there are a number of techniques for this.

--make sure directories that store things like templates and code at the very minimum are exluded in robots.txt

--better yet, any directory that doesn't HAVE to be accessible via the web should be .htaccess protected or stored outside your web path

--chmod is your friend. directories should be 755, files should be 644.

--patch early patch often. when a security patch for any script is released, everyone can immediately see where the holes are in the previous version and script kiddies will go looking for installations that haven't been upgraded.

--for the reason above, do not let version numbers of scripts display publicly.

--use strong passwords on all your admin areas, always use SSH and secure FTP

[sarettah]

Originally Posted by Nymph

Yeah pretty sure, they injected a string into my categories. I did a search, and this hack has been found before, but no fix for it, and they didn't give a lot of details.

and I don't want to hear about the tgp hack, I just got TGPX yesterday to set up

Hey

Did you already send me a copy of that script? If not, throw one my way. It is pretty easy to protect against sql injection in most cases.