Il sito svedese di WLM è stato più o meno defacciato. Ora è stato sistemato, nella mail seguente si vede che il motivo era legato ad uno script presente in un plugin chiamato "haybase-plugin" che era necessario per usare una certa versione del tema WLM creato dagli olandesi. Da un primo controllo pare che wikilovesmonuments.it non abbia questo plugin installato[1], ma preferirei anche se qualcun'altro ci potesse dare unocchiata e confermare. Il thread rilevante è sulla lista internazione di WLM[2].
Cristian [1]http://www.wikilovesmonuments.it/wp-admin/plugins.php [2]http://lists.wikimedia.org/pipermail/wikilovesmonuments/2012-August/003659.h...
---------- Forwarded message ---------- From: Tamara Petrovic bebauautu@gmail.com Date: 2012/8/23 Subject: [Wiki Loves Monuments] Swedish WLM site is hacked.... To: wikilovesmonuments@lists.wikimedia.org
http://wikilovesmonuments.se/in-english/
I clicked on it to see some info and this is what I found....Please fix!
---------- Forwarded message ---------- From: Holger Motzkau holger.motzkau@wikimedia.se Date: 2012/8/23 Subject: Re: [Wiki Loves Monuments] FW: Swedish WLM site is hacked.... To: wikilovesmonuments@lists.wikimedia.org
Hej!
Our installation and our plugins are all up to date.
The problem is the haybase-plugin which we installed to use the blue Dutch WLM skin. It contains a file called timthumb.php with the following code:
// external domains that are allowed to be displayed on your website $allowedSites = array ( 'flickr.com', 'picasa.com', 'blogger.com', 'wordpress.com', 'img.youtube.com', 'upload.wikimedia.org', );
[...]
foreach ($allowedSites as $site) { if (strpos (strtolower ($url_info['host']), $site) !== false) { $isAllowedSite = true; } }
And the check there is stupid. It just checks if an external url contains flickr.com, not if the url is actually flickr.com. Using this, manipulated gif images were downloaded from http://flickr.com.aseana.com.my/xc0de.php and ended up in the cache folder for scaled images where it later was executed as php files.
It seems only the index.php was replaced and another text file was added.
As we switched to Elyas red skin last weekend I just removed the old WMNL skin and the haybase plugin.
Regards, Holger
-- Styrelseledamot, kassör
Wikimedia Sverige Box 500 SE-101 29 Stockholm
Org.-nr. 802437-8310 http://www.wikimedia.se/
From: odder.wiki@gmail.com Date: Thu, 23 Aug 2012 16:32:22 +0200 To: wikilovesmonuments@lists.wikimedia.org Subject: Re: [Wiki Loves Monuments] Swedish WLM site is hacked....
Hi Jan, I see you've taken the website offline already -- please let us know what happened so we could see if the other WLM sites are not in danger of being "own3d".
Thanks
Tomasz W. Kozłowski a.k.a. [[user:odder]]