How to remove my CMS exploits?

[Aruthra]

Ok so recently my hotel is getting SQL injected... The hackers just get into my database, change users's motto, mess up homeroom, mess up staff page etc....
Could anyone help me patch and remove all the exploits present in my RevCMS edit? I would give you a rank on my hotel if you help me

Skype - tiny.builder
Hotel - swift-hotel.net

Thanks.

 

[Jerry]

If you're using xampp, that's so in-secure! I prefer using IIS to keep your stuff secured and database.

 

[Aruthra]

If you're using xampp, that's so in-secure! I prefer using IIS to keep your stuff secured and database.

i"m already using IIS only brah

 

[Aruthra]

Someone please help me...

 

[Khalil]

If you're using xampp, that's so in-secure! I prefer using IIS to keep your stuff secured and database.

XAMPP's security issues can be sorted, however, it is best to only use it on a development environment not on a live one.

Not to get down to the real problem! You said the attackers got access to the database, now this goes beyond any exploits known to any habbo content management systems, the attackers could execute a piece of code that could make changes to your database and/or drop certain tables or even the entire database itself yes, however, they cannot view the data parsed/inserted/present in the database. If the attackers are able to view that data, this means they either have a shell put onto your system OR someone has access to your server.

Otherwise, can you paste your 'class.users.php'?

 

[Zymf]

You must be registered for see links

 

[Aruthra]

XAMPP's security issues can be sorted, however, it is best to only use it on a development environment not on a live one.

Not to get down to the real problem! You said the attackers got access to the database, now this goes beyond any exploits known to any habbo content management systems, the attackers could execute a piece of code that could make changes to your database and/or drop certain tables or even the entire database itself yes, however, they cannot view the data parsed/inserted/present in the database. If the attackers are able to view that data, this means they either have a shell put onto your system OR someone has access to your server.

Otherwise, can you paste your 'class.users.php'?

Sure.

You must be registered for see links

 

[Khalil]

Here, replace it by this:

You must be registered for see links

; Now go to your class.core.php:

replace this:

    final public function handleCall($k)
    {
        global $users, $template, $_CONFIG;
      
        if($_CONFIG['hotel']['in_maint'] == false)
        {
            if(!isset($_SESSION['user']['id']))
            {
                switch($k)
                {
                    case "index":
                    case null:
                    case "login":
                        $users->login();
                    break;
                  
                    case "register":
                    $users->register();
                    break;
                  
                    case "forgot":
                        $users->forgotten();
                    break;
                  
                    case "maintenance":
                    case "ToS":
                        //
                    break;
              
                    case "me":
                    case "account":
                    case "news":
                        header('Location: '.$_CONFIG['hotel']['url'].'/index');
                        exit;
                    break;
                  
                    default:
                        //Nothing
                    break;
                }
            }
            else
            {
                if($_SESSION['user']['ip_last'] != $_SERVER['REMOTE_ADDR'])
                {
                    header('Location: '.$_CONFIG['hotel']['url'].'/logout');
                }
              
                switch($k)
                {
                    case "index":
                    case null:
                        header('Location: '.$_CONFIG['hotel']['url'].'/me');
                    exit;
                    break;
                  
                    case "register":
                    header('Location: '.$_CONFIG['hotel']['url'].'/me');
                    exit;
                    break;
                  
                    case "forgot":
                        header('Location: '.$_CONFIG['hotel']['url'].'/me');
                        exit;
                    break;
                  
                    case "client":
                        $users->createSSO($_SESSION['user']['id']);
                        $users->updateUser($_SESSION['user']['id'], 'ip_last', $_SERVER['REMOTE_ADDR']);
                        $template->setParams('sso', $users->getInfo($_SESSION['user']['id'], 'auth_ticket'));
                    break;
                      
                    case "help":
                        $users->help();
                    break;
              
                    case "account":
                        $users->updateAccount();
                    break;
                  
                    default:
                        //nothing
                    break;
                }
            }
        }
        elseif($_GET['url'] != 'maintenance')
        {
            header('Location: '.$_CONFIG['hotel']['url'].'/maintenance');
            exit;
        }
    }

by this:

    final public function handleCall($k)
    {
        global $users, $template, $_CONFIG;
      
        if($_CONFIG['hotel']['in_maint'] == false)
        {
            if(!isset($_SESSION['user']['id']))
            {
                switch($k)
                {
                    case "index":
                    case null:
                    case "login":
                        $users->login();
                    break;
                  
                    case "register":
                    $users->register();
                    break;
                  
                    case "maintenance":
                        //
                    break;
              
                    case "me":
                    case "account":
                    case "news":
                        header('Location: '.$_CONFIG['hotel']['url'].'/index');
                        exit;
                    break;
                  
                    default:
                        //Nothing
                    break;
                }
            }
            else
            {
                if($_SESSION['user']['ip_last'] != $_SERVER['REMOTE_ADDR'])
                {
                    header('Location: '.$_CONFIG['hotel']['url'].'/logout');
                }
              
                switch($k)
                {
                    case "index":
                    case null:
                        header('Location: '.$_CONFIG['hotel']['url'].'/me');
                    exit;
                    break;
                  
                    case "register":
                    header('Location: '.$_CONFIG['hotel']['url'].'/me');
                    exit;
                    break;
                  
                    case "client":
                        $users->createSSO($_SESSION['user']['id']);
                        $users->updateUser($_SESSION['user']['id'], 'ip_last', $_SERVER['REMOTE_ADDR']);
                        $template->setParams('sso', $users->getInfo($_SESSION['user']['id'], 'auth_ticket'));
                    break;
              
                    case "account":
                        $users->updateAccount();
                    break;
                  
                    default:
                        //nothing
                    break;
                }
            }
        }
        elseif($_GET['url'] != 'maintenance')
        {
            header('Location: '.$_CONFIG['hotel']['url'].'/maintenance');
            exit;
        }
    }

Now go on 'interface.users.php' and remove: 'public function forgotten();' & 'public function help();'. Make sure you do this, if you don't it will return a blank white page or an error.

See if the attackers can cause damage again, let me know if they do.

 

[Aruthra]

Okay lemme try it now thanks

 

[Aruthra]

@Khalil Okay i've done it, do i have to remove the following?

Topstats, badgeshop, tags, botshop, tokenshop, etc?

 

[j0sh]

I'd reccomend a new CMS. It's alot of work. a good cms is an old boonCMS edit- javasex released this a while ago

 

[Aruthra]

I'd reccomend a new CMS. It's alot of work. a good cms is an old boonCMS edit- javasex released this a while ago

Okay thanks.