Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a client who's asked me to try and analyze a site for vulnerability.

What's happening is, every weekend or so, on field of one record of one table in the database gets changed to the same thing every time. From Jewelry to Jewelery <a href="http://[**REMOVED-FOR-SF**]/viewPress?press_id=407">[**REMOVED-FOR-SF**]</a><a href="http://[**REMOVED-FOR-SF**]/[**REMOVED-FOR-SF**].html">[**REMOVED-FOR-SF**]</a>. The fact that it's always the same record makes me think it's some sort of automated script, but if it is, I can't find it.

The following has been accomplished:

  • Fixed SQL injection vulnerabilities
  • Prevented PHP execution in 777 directories
  • Changed the database password after every fix
  • Changed the CMS password after every fix

What's the next step?

share|improve this question
1  
Are you logging HTTP requests in the Web Server (Apache, IIS, etc.)? –  gravyface Sep 13 '10 at 23:07
3  
How are you completely sure that you've eliminated all SQL injection vulnerabilities? –  Hello71 Sep 13 '10 at 23:09
2  
Are you totally sure that this isn't being done by code on your own site? –  John Gardeniers Sep 13 '10 at 23:17
    
@gravyface @Hello71: I've set up a timestamp field in the database that told me when that record was edited. When it was again, I cross-referenced it with the Apache logs and didn't find anything that looked weird. –  Matt Alexander Sep 13 '10 at 23:23
    
@John: Well, I didn't write it so I guess it's a slight possibility, but there isn't really too much write access except for from within the CMS, which I believe is secure (changed passwords; SQL inject fixes). –  Matt Alexander Sep 13 '10 at 23:25
show 8 more comments

6 Answers

up vote 5 down vote accepted

The attacker most likely doesn't need to know the password to execute the change - here's how I would address it:

Locate the query function wrapper for your CMS and update it to log to a file and/or send an e-mail whenever a regexp on the query string matches your spam string - include any and all relevant server and CMS variables which may help identify the source of the issue.

Note that you can call debug_backtrace() on PHP 4.3+ to isolate include files if this could be the work of a malicious plug-in.

share|improve this answer
    
Unfortunately, the site uses direct calls to mysql_query() all over the place, but I think this sounds like a great direction to head in. It's not really a big deal to write a wrapper for mysql_query() and point everything towards it. –  Matt Alexander Sep 15 '10 at 11:38
add comment

Probably a leftover injection attack - can you set up a DB trigger to let you know when the record changes again? Then correlated that with your webserver logs - should lead to the culprit immediately.

Also ensure you are logging as much as you can get away with (referrers, etc)

share|improve this answer
    
I've set up a timestamp field in the database that told me when that record was edited. When it was again, I cross-referenced it with the Apache logs and didn't find anything that looked weird. –  Matt Alexander Sep 15 '10 at 11:07
add comment

Have you looked at the SQL server yet? Maybe there is a script running there or some procedure is setup to make an update that was done for a legitimate reason (or even just testing purposes) and has since been forgotten but is still getting triggered. Likely has some hard coded values like that typo.

share|improve this answer
add comment

Did you install a link generator in your CMS? Some sites automatically link to generate backlinks to blog posts. This looks like the same sort of thing. Check your CMS's extensions and see if there's something in there.

share|improve this answer
add comment

How heavily loaded is the site? Perhaps a packet capture could be an option, showing you anything and everything that came through from the outside world when this changed. This will at least let you know if something internal to the server is changing things, or where your vulnerability is.

share|improve this answer
add comment

You could setup modsecurity and add a rule to log the POST data whenever it sees the misspelled version. If it is someone editing it, or a SQL injection it should get logged.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.