Database is hacked over and over again; already cleaned the site for SQL injection

Question

I have a client who's asked me to try and analyze a site for vulnerability.

What's happening is, every weekend or so, on field of one record of one table in the database gets changed to the same thing every time. From Jewelry to Jewelery <a href="http://[**REMOVED-FOR-SF**]/viewPress?press_id=407">[**REMOVED-FOR-SF**]</a><a href="http://[**REMOVED-FOR-SF**]/[**REMOVED-FOR-SF**].html">[**REMOVED-FOR-SF**]</a>. The fact that it's always the same record makes me think it's some sort of automated script, but if it is, I can't find it.

The following has been accomplished:

• Fixed SQL injection vulnerabilities
• Prevented PHP execution in 777 directories
• Changed the database password after every fix
• Changed the CMS password after every fix

What's the next step?

Answer 1

The attacker most likely doesn't need to know the password to execute the change - here's how I would address it:

Locate the query function wrapper for your CMS and update it to log to a file and/or send an e-mail whenever a regexp on the query string matches your spam string - include any and all relevant server and CMS variables which may help identify the source of the issue.

Note that you can call debug_backtrace() on PHP 4.3+ to isolate include files if this could be the work of a malicious plug-in.

Answer 2

Probably a leftover injection attack - can you set up a DB trigger to let you know when the record changes again? Then correlated that with your webserver logs - should lead to the culprit immediately.

Also ensure you are logging as much as you can get away with (referrers, etc)

Answer 3

Have you looked at the SQL server yet? Maybe there is a script running there or some procedure is setup to make an update that was done for a legitimate reason (or even just testing purposes) and has since been forgotten but is still getting triggered. Likely has some hard coded values like that typo.

Answer 4

Did you install a link generator in your CMS? Some sites automatically link to generate backlinks to blog posts. This looks like the same sort of thing. Check your CMS's extensions and see if there's something in there.

Answer 5

How heavily loaded is the site? Perhaps a packet capture could be an option, showing you anything and everything that came through from the outside world when this changed. This will at least let you know if something internal to the server is changing things, or where your vulnerability is.

Answer 6

You could setup modsecurity and add a rule to log the POST data whenever it sees the misspelled version. If it is someone editing it, or a SQL injection it should get logged.