IndexScript sites - apply hack fix

[gkd_uk]

Hi

If you are using the IndexScript software for your directory, there is a sql injection hole in the script which is allowing hackers to hack the database and then the site.

A fix is available which can be found at indexscript sql injection hole fix - IndexScript Forum

Any directory script can be attacked this way so I think you should all check and confirm with the script developer.

Also make a backup of your site and your SQL databases as the hackers checking for vulnerable sites which can be hacked via SQL injections.

Thanks

[temi]

Thanks for this info, I know Bagi use that script as well, I hope he is aware. I will PM this url to him

[gkd_uk]

I have already sent him a pm and he has replied

[Bagi Zoltán]

Unfortunatly my site was also hacked yesterday night 10pm. I was very lucky and could repair the site without any db backup, login was a little interesting since the nice guy changed my password. Otherwise my site was hacked again in the morning. They placed the description meta tag with a meta-refresh.

I have just changed the codes pointed by GKD, thank you again.

[gkd_uk]

No problem Bagi

I visited the directory forum earlier and found the info. The developer has tested it and said all seems fine.

I guess I was too late. If I had known earlier, I would have sent you the fix before your site got hacked

[temi]

sorry to hear about this....good luck guys

[gkd_uk]

Thanks Temi

Hopefully the fix has resolved this problem. I guess I would have been next to be hacked if I had not found the fix but these hackers always find another way

[gkd_uk]

Some details on the hack can be found below. I guess this is the way they are hacking

IndexScript <= 2.8 (show_cat.php cat_id) SQL Injection Vulnerability

[Bagi Zoltán]

I've just checked my hittail log and it seem that many new nice guy arrive to my site with the "This site is powered by indexscript" referral keyphrase. When my site was attacked i immediately remove this line form the template. ARRRRGGHHHHH!!!

[temi]

So "This site is powered by indexscript" is what they have been using to find index script powered sites