[OT]OpenRPN.org hacked, AGAIN

[.]

Please see Here. It now says "::.HACKED BY iSKORPiTX (TURKISH HACKER).::"

This is ridiculous. Don't they know how to configure a server?

[Geir Isene]

It is not about configuring a server, it's about choosing the right, secure CMS.

[Mustafa Kemal]

Cok guzel!

Vaporware like OpenRPN is almost deserving of something like this...

[Hugh Evans]

The problem is postnuke and has only been a problem for the past few months. I agree that it is out of hand but it will take a bit of time for us to set up a more secure alternative.

[Johnny]

Try DRUPAL. I hear it's a great CMS.

[bill platt]

Maybe I'm just ignorant, but isn't the server supposed to be read-only to the outside world, with the exception of forum posts?

How can it be possible to "hack" a server like this?

[Marcus von Cube, Germany]

I'm not a specialist in this but I've read something about hacking of database applications on the web.

One possible problem is dynamic SQL: Normally, your posts are enclosed in some SQL statements to put them in to a database:

insert into mytable( poster, text ) values( '<poster>', '<text>' )

The values in angle brackets come directly from the input form. Now consider a poster named "badguy" enters something like this in the text field:

' );

update sometable( colum1, column2 ) values( 'bad value1', 'bad value2

Now lets combine the two:

insert into mytable( poster, text ) values( 'badguy', '' );

update sometable( colum1, column2 ) values( 'bad value1', 'bad value2' )

One can imagine that evil things can be done if the exact database structure is known (as is the case for many such systems.)

Marcus