[y2ksw]

Originally Posted by s_cocis

Hi y2ksw ,

from some days, an unknown users, uses "sql injection" in the rbs_banners table appending malware script in the field "text"

there are vulnerabilities to be corrected?
Can you help me ?

Thank you
Sandro
vbulletin: 3.8.9 Patch Level 1
PHP: 5.3.8
MYSQL: 5.5.16

Everything is correctly escaped, but if some malicious software has access to your forum, it can do what it wants.

The most recent WORM attacks write directly to the plugin cache and are untraceable through the plugin list. The real problem however are one or more scripts which have been introduced to your system or site, which can be called from attackers at will.

I have solved the problem with a dedicated server and strict rules: 1 forum administrator, 1 system operator, secure Apache build (no fast_cgi etc) with security modules enabled, binding and local security rules for PHP (open_basedir, upload_tmp_dir to dedicated folders for each site), and, last not least, fail2ban against insisting hackers.

To clean a broken system, practice has revealed that downloading all scripts and passing them through Avast helps to find all hacked scripts and intruders, while printing styles, plugins and cache tables help to find already injected code.

All together it takes 10-20 minutes to clean an infected system, but unless then, everything is "mayhem".