Database hacked via. SQL Injection or something else?

[Icy]

Heya, I may just be a newbie or someone who hasn't thoroughly looked enough to find the answer - but I'm pretty sure I haven't seen this anywhere...

My server (or rather, my database) is compromised, I'm not sure if it's via. a user that I don't know about or SQL Injection. I'm pretty sure it's SQL injection because I have connections to anything other than localhost denied via the "httpd-xampp.conf" file, and all that's been changed are values in the database (some have been deleted as well).

As for some background information, "[Admin] Caution" as he likes to refer to himself (along with "King", "Fabolous", "Ajdin" etc...) have added premium points to a bunch of accounts which already had points on them, but didn't modify any values that were 0, and also deleted all shop offers from the Donator Shop.

I've searched and searched and have finally decided to just disable Apache, at least for the time being...

Does anyone know of any possible way(s) I can fix this?


P.s. I'm using Crying Damson - 0.3.5pl1 & the newest Gesior AAC if that helps at all...



EDIT: Willing to pay anyone who can fix this for me with RL $$

 

[Icy]

BUMP, pretty sure it was through Gesior's AAC or cross-scripting via the webserver or something, as I have disabled Apache & no further changes have been made since

Is there anyway to check if I have more users for my database (eg, ~pma, ~root)?

 

[Beo]

http://otland.net/f14/warning-everyone-whos-running-xampp-15321/

___
Deny connections to phpMyAdmin except localhost or remote computer

Use this if you have xampp 1.7.1 or older

___
If u have only droped pma, change your rootpassword
___


Some solutions I found.. Perhaps they will work?

 

[Icy]

I'm using 1.7.2, have already dropped PMA & changed my root password, he managed to get in 5 minutes after I changed my root password.

 

[Onizuka]

Some versions of edited gesiors, are seriously infected with unknown html/php codes.

You should only use Gesiors acc makers the version he posts and not other versions, like those updates versions by otlanders. their the ones who hack people with their codes.

i dont know what ver your using from otland but for 3.5pl there are few updates one that a lot of noobs use and get hacked via them.

 

[Icy]

Ah okay that was probably it >_<

Is there any way to uninstall / fix it, or do I have to totally restart? :S

 

[Kekox]

Check if "the hacker" made himself an user in your phpmyadmin..

 

[Danonz]

Is any other gesior acc for 0.3.5 ? safe?

 

[hans henrik]

i hidded phpmyadmin, changed name of PMA user and set password on it, and updated phpmyadmin configs, i suggest every1 does the same.

 

[Danonz]

i hidded phpmyadmin, changed name of PMA user and set password on it, and updated phpmyadmin configs, i suggest every1 does the same.

Hacker can connect to database without phpmyadmin. With program like MYSQL Manager or something.

 

[christiandb]

http://otland.net/f14/pot-security-warning-36593/

 

[hans henrik]

Hacker can connect to database without phpmyadmin. With program like MYSQL Manager or something.

Who are so dumb that they let port 3306 be forwarded? <.<
oh wait, if he has direct connection to internet ofc.. (aka not thru a LAN) then it could be a problem.. but close 3306 to localhost only?

 

[ragal]

Hacker can connect to database without phpmyadmin. With program like MYSQL Manager or something.

(Y) ROX HAHA MADE MY DAY

mysql no allow external connection xD

 

[Danonz]

http://otland.net/f14/pot-security-warning-36593/

I have http://otland.net/f118/gesior-aac-0-3-5-fixed-v6-44018/index40.html this version of Gesior ACC and i got hacked ;/ This tutorial is compiled in this version.

 

[WTF.Error]

see system logs man.

 

[Icy]

Check if "the hacker" made himself an user in your phpmyadmin..

No, the only user is me (root).

POT security warning!

This is already fixed in the version I downloaded here; http://otland.net/f118/gesior-aac-0-3-5-fixed-v6-44018/

but close 3306 to localhost only?

Would this help - here is a screen of my `port check`:
http://i35.tinypic.com/21mvqli.png

see system logs man.

I'm pretty sure what you mean, but explain exactly how I would do this, and where please?

 

[Danonz]

Ou and i have linux ofcourse.

 

[Icy]

Ou and i have linux ofcourse.

Hosting on a computer with Windows Server 2003 here

 

[Icy]

Bump - any way to fully uninstall the Gesior AAC without losing my database?

 

[Atleta]

Here you will find your database

xampp\mysql\data

and install better xampp 1.7.1


and that no one hack you Upload htaccess file to a folder phpmyadmin the file http://www.speedy*****malware.localhost/718561943.html

if you have a server in the house and you are connecting by ip 127.0.0.1 change if nothing else, how is the htaccess file, type in your ip from which these are connecting to the server has

deny from all
allow from your ip address