Topic: Attempted Hack???

[Ken (OP)]

At about 2:42PM today the error log shows 100+ Critical Errors spaced at about 1-2 seconds apart. To me it looks like someone tried to hack into the site through the TinyPortal Article system.

Opinions? 

Code: [Select]

Guest
Apply Filter: Only show the error messages of this IP address 198.54.114.54 
  Reverse chronological order of list Today at 02:43:26 PM
Apply Filter: Only show the error messages of this session 2424e612978426892df64ca8113d5aab
Apply Filter: Only show the errors of this type Type of error: Critical
Apply Filter: Only show the error messages of this URL
https://www.ourfamilyforum.org/FamilyForum/index.php?amp;action=tpadmin;sa=editarticle242+%27-6863+union+all+select+1,1,1,1,1,1,1,1,1,CONCAT(0x3a6f79753a,0x4244764877697569706b,0x3a70687a3a)%23
Apply Filter: Only show the errors with the same message
Wrong value type sent to the database. Integer expected. (subtype)
Function: do_articles
Apply Filter: Only show the errors from this file
File: /home/ourfamil/public_html/FamilyForum/Sources/TPortalAdmin.php
Line: 1624

[Ken (OP)]

It has just started again as I am doing this topic, the count is now 234 and counting. 
Whois-RWS and IP Lookup showing as in the attached screenshots.

[Skhilled]

Actually, I see this now for several mods including the arcade and Gallery which are updated...I didn't go through the entire log due to there being 109 pages! I can only assume it has to do with an outdated mod conflicting with other mods which is what most hackers go after. That's not to say that newly updated ones can't be hacked, tho.

Best to block outdated mods from guests until you can update them or uninstall them. You cannot keep very old/outdated mods! It's a hacker's dream!

[Ken (OP)]

I just slogged through all 1053 Critical entries in the error log and they were divided between two files:
/Sources/ArcadeList.php (arcade;sa=stats).
/Sources/TPortalAdmin.php (tpadmin;sa=editarticle242).

Permissions are now set to 'Disallow' for the Arcade, but I'm still working on the TP Articles permissions.

[Ken (OP)]

Actually, the TP permissions are available for members but not guests.

[Skhilled]

I was pretty sure I saw one for the gallery, too...

[Ken (OP)]

Gallery and Media access turned off now.