(08-15-2013, 01:29 AM)leen12 Wrote: no i dont have a backup the site is only 12 days old =s lol

i tried to upload the origional files but it returned the same..

you think i should just wipe everything or what? =s

(08-15-2013, 01:52 AM)leen12 Wrote: ok i found how they did it anyway.. i think..

it seems they uploaded a jpg that was infected..

(08-16-2013, 08:47 AM)gabby Wrote: hi,. im gabby,.. ^_^
this is ur site right,.?
sorry for ur site,.. but im not target it,..
thats random attack on phpVibe 3.1,..
am developing bot n im just test my bot for own it,.
it just use xss script on ur "edit-profile.php"

ok,.. for pacthing,. u can do this :
open vibe-cp/users.php
add this at the beginning, right after:

Code:

<?php include_once("header.php");

add:

Code:

function antixss_light($text) { //Remove external scripts $search = array( '@<script[^>]*?>.*?</script>@si', // Strip out javascript '@<style[^>]*?>.*?</style>@siU', // Strip style tags properly '@<![\s\S]*?--[ \t\n\r]*>@' // Strip multi-line comments ); $tx_output = preg_replace($search, '', $text); //Deep remove the rest $injections = array('link','script','iframe','object','applet','embed','onblur','onchange','onclick','ondblclick','onfocus','onkeydown','onkeypress','onkeyup','onload','onmousedown','onmousemove','onmouseout','onmouseover','onmouseup','onreset','onselect','onsubmit','onunload', 'src', 'href'); $output = str_replace($injections, '', $tx_output); return strip_tags($output, '<ul><ol><li><code><cite><strong><p>'); }

find:

Code:

<?php echo $rrow['display_name'];?>

and change it to

Code:

<?php echo antixss_light($rrow['display_name']);?>

browse to the admin users page, find the user in case, delete it.
empty cache in site/cache
you should be fine.

Or alternatively (if you don't want to clear cache) you can do the same on tpl/sidebar.tpl.php (copy function to top) and change:

Code:

'.$row["display_name"].'

to

Code:

'.antixss_light($row["display_name"]).'

just it,.. n sorry for my bad english,. ^_^

(10-07-2013, 05:59 PM)lehieu77 Wrote: I'm using wordpress.
My website is hacked by gabby.
A text added before title for admin-cp, page, post is "hacked by gabby".
How do to fix it ?