Loading...
 
Skip to main content

Architecture / Installation

Forum List Topic List

 
Thread actions
Print this page
  • Print all pages

    • Help: Tiki Security / upgrade?

    Posted by bluesand

    Hi,

    Been a while since I installed tikiwiki, and haven't been keeping up with the upgrades. A new user sent me an email saying the validation email had redirected him to an 'unsavoury website'.

    Am trying to look into it, and am not sure where to start. Wondering if it is possible that my tiki has been compromised.

    a) How do I check what version I'm currently running, so that I may upgrade.
    b) Security check returned the following:

    ./styles/style.php This is not a Tikiwiki file. Check if this file was uploaded and if it is dangerous.
    ./db/local.php This is not a Tikiwiki file. Check if this file was uploaded and if it is dangerous.
    ./files/lndex.php This is not a Tikiwiki file. Check if this file was uploaded and if it is dangerous.

    Do these files belong to tiki? Or am I in dire need to cleanup my install?

    Thanks.

    Reads: 1131
    Posted by bluesand

    Looking into the files a bit more, I'm 100% certain my wiki has been compromised. =(
    Could someone advise on how I should go about cleaning it up? =(


    Posted by Gary Cunningham-Lee

    One way to check the version is to look at templates/tiki-top_bar.tpl. That's where the version number is hand-written before a release. I'm not sure if there's some way to generate the version number with Tiki code.

    Tiki has no styles/style.php or files/lndex.php (note the "l" rather than "i"), and its db/local.php is a simple file with only your database connection information, so you can look at this file's contents to know if it's been modified.

    Since these aren't bona fide, there may well be more. (I found divs full of nasty links appended to three or four php files in one of my Tiki sites a while back, with large negative margins to prevent them from visibly displaying. I suppose they could be seen by scripts or something for some evil purpose.)

    Yes, I'd say you're in dire need of a cleanup. I'd do an install that overwrites every file, and check (compare a fresh archive to what's on the server) to make sure there are no extra files.

    -- Gary


    Posted by bluesand

    Loooking into it even more:

    I installed 1.9.8 (found the original .tar.gz file still on the server); current version is 1.9.8.3 (which I will be installing soon).

    Wondering things like
    a) how did they get in? (and does 1.9.8.3 fix this?)
    b) is it just the tiki files? Or has my database been compromised?
    c) Is it possible that even the server has been compromised?

    There are extra lines appended to my local.php where I found the redirect address to the site my user had mentioned.

    From timestamps of these files, it would appear they got in on Oct 26 (or earlier...).

    =(


    Posted by bluesand

    Am still looking into it. This much I've found out:

    I'm running Tikiwiki 1.9.8
    I believe the point of entry was via tiki-graph_formula.php

    Is there a better place to be discussing security issues? Or is this the right forum?