Kryptronic Software Support Forum

Thanks for the thoughts. The cart has been stable for a long time and the only table to have been uploaded is the product.csv. The site was then swapped over to MYSQL (I do updates off line in an access database and then move them onto the site).

I am trying to get hold of the hosting company to find out if they have migrated me onto another server.

I've looked at the cp-admin.cgi and cp-app.cgi files in the CGI Bin and they seem to have the same path statements on both files. The file updates dates are 11/10/2008 which makes me think someone has been in there and changed files/paths recently. I havn't alterned those files and most other files on the site are dated 2004.

My product.csv table is dated 4/10/2008 which is about right for when I last updated the content.

It looks like the host has migrated me without telling me, I just need to work out where and what has happened now.

Any more thoughts are welcome

Nick

Any idea where to  look??

The permissions on CP-app and CP-admin are identical.

I can't get a reply from my host at the moment.

Nick

Sorry, Nick... that doesn't give much to go on.  I'd have a look at the permissions on all of the PERL files... cgi-bin/ccp51/library and all the subdirectories.  All of them should be set to 755.  If not permissions, it's likely that the host did something... what I don't know, but something.  Beyond that, I've got nuttin' and I'd have to suggest a paid support ticket with Howard (greenbarn) or Stephen (cartmod.com) if your host can't help you sort it.  Sorry.

Have a look at the permissions on all of the PERL files... cgi-bin/ccp51/library and all the subdirectories.  All of them should be set to 755.  After that, get in touch with Stephen at cartmod.com and pay him to find the problem - there's nothing more that can be done from here with the information you've provided.

Either of those path definitions could be right - it depends on how your server is set up.  Whatever version of the paths work in cp-app.cgi, should also be the right general format to work in cp-admin.cgi; so make cp-admin.cgi of the same style as cp-app.cgi if you need to.  I'm not inclined to think the issue is there though - that bit at the end of the live version is almost certainly the problem.  I have no idea where that would have come from and it certainly doesn't belong there.  Frankly, from the looks of that script, I'm suspecting you were hacked.  The only good news is that the syntax of that apparent hack attempt is flawed and will keep the CGI from executing.  The last part of that script, starting with where you pasted in, should look like this:

print "The root web directory of this account appears to be:<BR><BR>\n";
print "$ENV{'DOCUMENT_ROOT'}<BR><BR>";

print "</BODY></HTML>\n";

} ######### End of if statement.

#######################################################################
# Exit                                                                #   
####################################################################### 

exit;

That's everything from your start point right to the end of the file.  I would definitely delete this part:

******DELETED BY MODERATOR*******

You could comment it out instead of deleting it (by putting a # at the beginning of each line), but that script makes me nervous and I would not recommend that.  Instead, I recommend you keep a backup copy on your local machine and remove the suspect code.  If you've already compared the rest of the script against your original and you are sure that that code and the paths are the only differences, then you're probably ok to proceed once you've removed that code.  However, if you want to PM me the entire contents of the file I'd be happy to double-check for you.

EDIT: Removed malicious code from post for security purposes.

Last edited by rachaelseven (11-26-2008 15:47:17)

That's only slightly obfuscated code that will likely send the person off to a site where "bad things" will attempt to be downloaded and installed/run.  If you have that in one file it is well worth your effort to check every file on your site for signs of it elsewhere.

It was going to attempt to load a JS called quant.js from a site which I won't repeat here.  What quant.js was going to do from there is anyone's guess.  Fortunately, the script was very poorly written and could never execute, but it was definitely a hack attempt.  And Dave is absolutely right - your site has been seriously breached and I would check very carefully for other evidence of tampering - front end and back end.

EDIT: I have edited both earlier posts where the code appeared - malicious code has no place on the forum, now that we've identified it.

Last edited by rachaelseven (11-26-2008 15:48:11)

You're welcome, Nick, and I'd be happy to have a look at your file for you.  Hit the PM link below my name and you'll get a composition window.  Send me the cp-app.cgi file that is work, as well as the cp-admin.cgi file that isn't, and I'll see what I can do.  Please use the [ c o d e ] and [ / c o d e] notation (without the extra spaces) around the code blocks to make it easier to read.  You can follow he BBCode link here if you need to brush up on how to use those or other BBCode tags to make the message easier to follow.  Thanks.

Hi Nick,

Your cp-admin.cgi script looks ok.  The paths seem to be suitable and I couldn't find any syntax errors in the script.  There is no more sign of malicious code or anything I can see that would keep it from running.  At this point, all that's really left is check permissions again and then look for other problematic files.  You might also check the server error log again to see if the error has changed.  Last time, the error pointed straight at cp-admin.cgi and it was indeed the culprit.  That script looks right now, so perhaps the error has cascaded down to the next file being called.  initialize.pl would be a likely guess, but it could be several others also.  What's the log say now?

SORTED!!!!

I Googled the last error message and got this

http://forums.theplanet.com/lofiversion … 61003.html

His final post was that an editor had added hard returns and that was breaking this script. I checked mine and that was the case as well. Went back to the hacked version and used notepad to edit it and remove the hack, saved it, and uploaded it and I can get at the admin panel again.

Many thanks to Rachael and everyone for the ideas.

Nick

I'm  impressed with the quality of help here in the forums.

I've been using CCP51 for 4 years not and it's been very reliable.

I am not a professional programmer and have had no dealings with perl before so the hard returns caught me out.

Thanks again

Nick

Last edited by nickf (11-27-2008 18:17:43)