freshJet Posted February 5, 2012 Report Share Posted February 5, 2012 Luckily my site was restored without rebuilding the entire site. It was a close call. The only lpss was that e only have around 925 hours logged, comared to the 1000+ we had before. Pilots have lost a bit of a chunk out of their hours. I want to know what can be done to prevent future incidents with my VA and others using phpVMS. I was targeted with an SQL injection, which deleted many of my database tables. What can be done to protect them? Are they dynamic? And if so, is that a problem? Quote Link to comment Share on other sites More sharing options...
Moderators mark1million Posted February 5, 2012 Moderators Report Share Posted February 5, 2012 Do you know how they effected your tables as all built in sql queries are escaped to prevent this. What addons are you running and do you have your own queries built? Quote Link to comment Share on other sites More sharing options...
freshJet Posted February 5, 2012 Author Report Share Posted February 5, 2012 They deleted the tables. I have PopUpNews, Charts and FrontSchedules. I don't have my own queries. I tried to create my own modules - it might have done something. Quote Link to comment Share on other sites More sharing options...
Moderators mark1million Posted February 5, 2012 Moderators Report Share Posted February 5, 2012 Im not sure about charts the the others are escaped. Quote Link to comment Share on other sites More sharing options...
Tom Posted February 5, 2012 Report Share Posted February 5, 2012 Modules are wide open to exploitation, especially if they're poorly written - that's why I ended up modifying VAForum way back... Quote Link to comment Share on other sites More sharing options...
Administrators simpilot Posted February 5, 2012 Administrators Report Share Posted February 5, 2012 That was a cheap shot Tom....... Quote Link to comment Share on other sites More sharing options...
Strider Posted February 5, 2012 Report Share Posted February 5, 2012 I dont think he was saying anything about your modules simpilot, he was referring to modules as a whole, some people make them, just dont make them with enough security. The main thing to do is, create backups of your database an a regular basis, so if this happens again, you don't lose as much as you did this time. Also change the password to the DB, make sure to change the password in the local.config file too. Maybe also reduce the char limits on forms, so that really long lines of text cant be inserted. Quote Link to comment Share on other sites More sharing options...
Tom Posted February 5, 2012 Report Share Posted February 5, 2012 It wasn't intended as an insult to your coding abilities simpilot. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.