Forum Replies Created

Viewing 15 replies - 1 through 15 (of 38 total)
  • Thread Starter itpixie

    (@itpixie)

    Hello @yogajegstudio and The Gutenverse Team,

    Thank you for the additional information and for being transparent. I actually was considering upgrading to a paid tier. Is this ability to manage form actions outside the editor available for the Standard paid tier? All the Professional tier features are really nice, but I don’t need most of them right now. Standard paid tier seems to be a more reasonable investment at this time.

    Thanks again,

    Amy

    Thread Starter itpixie

    (@itpixie)

    Hello @yogajegstudio and The Gutenverse Team,

    Thank you very much for getting back to me, and for clarifying the new changes in 3.0.0.

    To answer your questions…

    Share screenshots of the issues where the form is not working, is there any error shown.

    Unfortunately, in my attempt to clean up the patterns that was getting the “Form Action Required” error and the orphaned forms, I deleted those patterns. Here’s a screenshot of where that error would have been, and I will describe what led to the issue…

    1. I started my site with the Kavana theme and made necessary styling and function modifications to suit my needs.
    2. Since I cannot actually edit the stock patterns that came with the theme — they are all locked, I made duplicates of the stock patterns that I need and made changes to the duplicates created by me.
    3. Prior to 3.0.0 update, I created one form action for email address collection (Form ID 822, “PB Newsletter Signup”), and used it in three different patterns (“PB Home Popup”, “PB Email Signup” and “PB Single Post Content”). All of these patterns are duplicates of selected Kavana stock patterns, linked to Form ID 822 and with my stylistic customization.
    4. When the plugin was updated to 3.0.0, I was notified about the duplicate form actions were created, and modifications to these clones wouldn’t change the original. I noticed each clone had ambiguous titles like “PB Newsletter Signup Clone 1”, I changed the titles of these clones to more accurately reflect which clone is linked to which pattern (see example below).
      • PB Home Popup – PB Newsletter Signup (ID 822, original form, no title change)
      • PB Email Signup – PB Newsletter Signup Main (ID 20xx, clone 1, title changed)
      • PB Single Post Content – PB Newsletter Signup Post (ID 20xx, clone 2, title changed)
    5. However after I closed the updated pattern and later reopened it for more edits, I saw the error “This form action does not exist on this site” error, and there was the Create Form Action button.
    6. So I clicked the “Create Form Action”, the form action edit popup opened, and had to fill in all the fields.
    7. Whenever I opened PB Email Signup or PB Single Post Content patterns, the Connected Form Action would flash then the “This form action doesn’t exist on this site” error popped up almost immediately and covered the Connected Form Action section. I repeated Step 6 a few times, and ended up created multiple clones of PB Newsletter Signup Main and PB Newsletter Signup Post forms. Each of these cloned forms have unique Form ID.
    8. I eventually created brand new forms for the patterns-in-questions (Form IDs 2076 & 2108)

    https://photos.app.goo.gl/2p7kRBChkJHYFm4W9

    Did the cloned/copied form actions end up with missing or incomplete data?

    So the forms were actually working as far as I can tell — When someone submit an email address via the form, the data is captured and saved in the form database. What’s not working was on the admin end, whenever I opened the pattern for edits, I would see those error message. The “Connected Form Action” section would flash for half a second, that the “This form action does not exist on this site” would pop up over it, and I would be asked to Create Form Action. So I was no longer able to edit the form action.

    Is this issue occurring only with the stock theme patterns (like the newsletter sign-up), or does it happen when you create entirely new forms from scratch?

    This issue happened to patterns that were duplicates of the stock theme patterns. As I mentioned before, I created a new form (Form ID 822) initially, and linked this form to multiple patterns (duplicates of stock patterns). After the plugin was updated, clones of Form ID 822 was created, and it was these clones that I was experience the error.

    The entirely new forms that I created (Forms IDs 2076 and 2108) do not have any issues. I am able to edit them without any errors. I am also able to delete any new form actions that I create now, in the Connected Form Action section.

    Any other clues that might help us

    The “This form action does not exist on this site” error seems to be isolated to the clones of Form ID 822. Based on my own observations, it seems the cloned forms, created when the plugin was updated, somehow get disconnected to the patterns they supposed to connect to.

    The original form, Form ID 822, does have any issue or error.

    My main issue at this point is trying to find a way to delete all the orphaned forms. Since they don’t seem to linked to any pattern, I cannot delete them through Edit Pattern –> Connected Form Action. And there is no way to view all the “Tracked Forms” in an easily accessible way. The only way I can see a complete list of them is through a drop-down menu on the “Entries from All Forms” page.

    Personally I would like to have the ability to easily see a list of “Tracked Forms” outside of the Entries page. I would also like the ability to mange the form outside of Edit Pattern –> Connected Form Action. I understand the need to enforce and protect the connection between forms and patterns. But in a case like mine, when those connections were corrupted, and no way to clean up the corrupted data, it is a bit frustrating.

    I hope I have provided the information you need to investigate the issue, and I hope everything I said made sense. I’m sorry I don’t have the screenshots you asked for, but please feel free to reach out if you need additional information.

    Thank you very much for looking into this.

    Sincerely,

    Amy (itpixie)

    Thread Starter itpixie

    (@itpixie)

    I’m closing this thread here because I realized Gutenverse Form has its own forum, and I have posted the issues with some additional information over there. Sorry for the confusions.

    itpixie

    (@itpixie)

    I would like to add that the suspected malicious URL Wordfence’s complaining about is

    creativebriefing[dot]com

    A scan using Virus Total reports this site has been classified as malicious by at least 4 URL scanners.

    It seems that the flagged files are referencing creativebriefing[dot]com to explain a certain malware infection symptom. And unfortunately the referenced site itself has been infected. The files themselves are harmless.

    If you are comfortable in modifying code, simply search for “creativebriefing” in the flagged files and delete the references. That should fix the issue. I did that and now Wordfence scan comes back clean.

    Hope this helps.

    Thread Starter itpixie

    (@itpixie)

    Hello OSE Firewall team,

    After trying to re-initialize the OSE Firewall database by dropping all OSE Firewall related tables, here’s the error I see in Firebug:

    Ext.Error: You’re trying to decode an invalid JSON String: <h1>CDbException</h1> <p>CDbCommand failed to execute the SQL statement: SQLSTATE[42000]: Syntax error or access violation: 1142 CREATE VIEW command denied to user ‘itpixiec_admin’@’localhost’ for table ‘itpx_osefirewall_aclipmap’. The SQL statement executed was: CREATE VIEW itpx_osefirewall_aclipmap AS select acl.id AS id,acl.name AS name,acl.status AS status,acl.datetime AS datetime,acl.score AS score,acl.visits AS visits, acl.country_code AS country_code,acl.host AS host,acl.notified AS notified,acl.referers_id AS referers_id,acl.pages_id AS pages_id,ip.id AS ipid,ip.ip32_start AS ip32_start,ip.ip32_end AS ip32_end,ip.iptype AS iptype from (itpx_osefirewall_acl acl left join itpx_osefirewall_iptable ip on((acl.id = ip.acl_id))); (/home/itpixiec/public_html/wp-content/plugins/ose-firewall/framework/db/CDbCommand.php:541)</p>

    #0 /home/itpixiec/public_html/wp-content/plugins/ose-firewall/framework/db/CDbCommand.php(376): CDbCommand->queryInternal('', 0, Array) #1 /home/itpixiec/public_html/wp-content/plugins/ose-firewall/framework/oseframework/db/oseDB2.php(58): CDbCommand->query() #2 /home/itpixiec/public_html/wp-content/plugins/ose-firewall/protected/library/oseFirewallInstaller.php(100): oseDB2->query() #3 /home/itpixiec/public_html/wp-content/plugins/ose-firewall/protected/models/DashboardModel.php(196): oseFirewallInstaller->createACLIPView('/home/itpixiec/...') #4 /home/itpixiec/public_html/wp-content/plugins/ose-firewall/protected/models/DashboardModel.php(86): DashboardModel->createACLIPView() #5 /home/itpixiec/public_html/wp-content/plugins/ose-firewall/protected/controllers/DashboardController.php(34): DashboardModel->actionCreateTables() #6 /home/itpixiec/public_html/wp-content/plugins/ose-firewall/framework/web/actions/CInlineAction.php(49): DashboardController->actionCreateTables() #7 /home/itpixiec/public_html/wp-content/plugins/ose-firewall/framework/web/CController.php(308): CInlineAction->runWithParams(Array) #8 /home/itpixiec/public_html/wp-content/plugins/ose-firewall/framework/web/CController.php(286): CController->runAction(Object(CInlineAction)) #9 /home/itpixiec/public_html/wp-content/plugins/ose-firewall/framework/web/CController.php(265): CController->runActionWithFilters(Object(CInlineAction), Array) #10 /home/itpixiec/public_html/wp-content/plugins/ose-firewall/framework/web/CWebApplication.php(282): CController->run('createTables') #11 /home/itpixiec/public_html/wp-content/plugins/ose-firewall/framework/oseframework/ajax/oseAjax.php(28): CWebApplication->runController('dashboard/creat...') #12 [internal function]: oseAjax::runAction('') #13 /home/itpixiec/public_html/wp-includes/plugin.php(406): call_user_func_array('oseAjax::runAct...', Array) #14 /home/itpixiec/public_html/wp-admin/admin-ajax.php(72): do_action('wp_ajax_createT...') #15 {main}

    And Admin Email mapping is still not working for me… My WP user id still doesn’t show up in the drop-down list, and I am unable to save any mapping even if I manually type in my user id.

    Thanks,
    itpixie

    Thread Starter itpixie

    (@itpixie)

    Hello Helix,

    Thank you so much for the Firebug info. One of the sites that I’m having problem initializing the database has the following SQL error:

    <h1>CDbException</h1>
    <p>CDbCommand failed to execute the SQL statement: SQLSTATE[HY000]: General error: 1005 Can’t create table ‘fireflys_wordpressdb.ffsd_osefirewall_acl’ (errno: 121). The SQL statement executed was:

    CREATE TABLE IF NOT EXISTS ffsd_osefirewall_acl (
    id INT(11) NOT NULL AUTO_INCREMENT ,
    name VARCHAR(300) NOT NULL ,
    status TINYINT(1) NOT NULL ,
    datetime DATETIME NOT NULL ,
    score TINYINT(3) NOT NULL ,
    country_code CHAR(2) NULL DEFAULT NULL ,
    host VARCHAR(300) NULL DEFAULT NULL ,
    notified TINYINT(1) NULL DEFAULT NULL ,
    referers_id INT(11) NOT NULL ,
    pages_id INT(11) NOT NULL ,
    visits INT(11) NOT NULL ,
    PRIMARY KEY (id) ,
    INDEX idx1_oseacl (referers_id ASC) ,
    INDEX idx2_oseacl (pages_id ASC) ,
    CONSTRAINT fk1_oseacl
    FOREIGN KEY (referers_id )
    REFERENCES ffsd_osefirewall_referers (id )
    ON UPDATE CASCADE,
    CONSTRAINT fk2_oseacl
    FOREIGN KEY (pages_id )
    REFERENCES ffsd_osefirewall_pages (id )
    ON UPDATE CASCADE)
    ENGINE = InnoDB
    AUTO_INCREMENT = 1
    DEFAULT CHARACTER SET = utf8 (/home/fireflys/public_html/dealers/wp-content/plugins/ose-firewall/framework/db/CDbCommand.php:541)</p>

    #0 /home/fireflys/public_html/dealers/wp-content/plugins/ose-firewall/framework/db/CDbCommand.php(376): CDbCommand->queryInternal('', 0, Array)
    #1 /home/fireflys/public_html/dealers/wp-content/plugins/ose-firewall/framework/oseframework/db/oseDB2.php(58): CDbCommand->query()
    #2 /home/fireflys/public_html/dealers/wp-content/plugins/ose-firewall/framework/oseframework/installer/wordpress.php(43): oseDB2->query()
    #3 /home/fireflys/public_html/dealers/wp-content/plugins/ose-firewall/protected/models/DashboardModel.php(159): oseInstaller->createTables('/home/fireflys/...')
    #4 /home/fireflys/public_html/dealers/wp-content/plugins/ose-firewall/protected/models/DashboardModel.php(56): DashboardModel->createTables()
    #5 /home/fireflys/public_html/dealers/wp-content/plugins/ose-firewall/protected/controllers/DashboardController.php(34): DashboardModel->actionCreateTables()
    #6 /home/fireflys/public_html/dealers/wp-content/plugins/ose-firewall/framework/web/actions/CInlineAction.php(49): DashboardController->actionCreateTables()
    #7 /home/fireflys/public_html/dealers/wp-content/plugins/ose-firewall/framework/web/CController.php(308): CInlineAction->runWithParams(Array)
    #8 /home/fireflys/public_html/dealers/wp-content/plugins/ose-firewall/framework/web/CController.php(286): CController->runAction(Object(CInlineAction))
    #9 /home/fireflys/public_html/dealers/wp-content/plugins/ose-firewall/framework/web/CController.php(265): CController->runActionWithFilters(Object(CInlineAction), Array)
    #10 /home/fireflys/public_html/dealers/wp-content/plugins/ose-firewall/framework/web/CWebApplication.php(282): CController->run('createTables')
    #11 /home/fireflys/public_html/dealers/wp-content/plugins/ose-firewall/framework/oseframework/ajax/oseAjax.php(28): CWebApplication->runController('dashboard/creat...')
    #12 [internal function]: oseAjax::runAction('')
    #13 /home/fireflys/public_html/dealers/wp-includes/plugin.php(406): call_user_func_array('oseAjax::runAct...', Array)
    #14 /home/fireflys/public_html/dealers/wp-admin/admin-ajax.php(72): do_action('wp_ajax_createT...')
    #15 {main}

    There are 2 WordPress installs using the same database, though each has their own set of tables (with different table prefix). Would that be the reason (2 WP installs using the same database) I’m encountering the sQL error? I had no problem initializing OSE Firewall database/tables on the 1st WP install.

    My other question is:
    Is there a way to force database initialization again, other than deleting the existing OSE Firewall tables?

    Thanks,
    itpixie

    Thread Starter itpixie

    (@itpixie)

    Hello Helix,

    Thank you so much for the update and all the information. I apologize for not being able to provide the info you asked for in time.

    After making some adjustment to my PHP environment, I was able to use the most updated version of OSE Firewall without any issue.

    I do have 1 additional question:
    As I was initializing the database for the first time, the process stopped/got stuck (or so it seems) half way through. As I closed the pop-up window and the page refreshed, it said everything was ready to do. How can I tell that all the database tables got created and initialized correctly? Or is there a way for me to re-initialize everything?

    Thank you so much again for all your and your team’s help!

    itpixie

    So it looks like GoDaddy has not really solved the issue on their end like they told me.

    I still have not been able to get GoDaddy to provide any more info in regards to what exploit(s) (they think) was used to hack the site. I definitely think those of you who are hosted on GoDaddy should contact them to let them know about the issue.

    In the meanwhile, here are some things I think that helped locking down the site, beside the usual WP clean up (http://codex.wordpress.org/FAQ_My_site_was_hacked):

    1. updated the salt values in wp-config.php
    2. updated my WP database password
    3. got rid of any unused themes and plugins — I suspect some kind of user creation script might have been added there in my case
    4. I use Wordfence to get alerted when admin level users login so I can better monitor who’s accessing the site. It also help scanning for malicious stuff.
    5. Ultimate Security Checker scans for malicious stuff in post and comments too, if you need a scanner for that.
    6. If you still have the default WP user “admin”, delete that ASAP. If that’s your username, set up a new admin user with a new username for yourself and delete the “admin” username
    Thread Starter itpixie

    (@itpixie)

    Hi jquindlen, just want verify that I was able to update to 3.0.12.

    Thank you so much for all your help!

    Ugh! WP removed the YouTube link and the exploit info link that I included…

    For the video:
    http://www.youtube.com/watch?v=eQxHtW9_6fE
    or Google “I-CEH.COM – WordPress 3.3.2 ADD ADMIN Exploit { Advisory } – Disclosure and Demonstration“

    For more info on the exploit:
    http://www.exploit-db.com/exploits/18791/
    or Google “WordPress 3.3.1 Multiple CSRF Vulnerabilities“

    By the way, I did hear from GoDaddy again and they gave absolutely nothing other than saying the site was hacked back in August via Uploadify (which I already know and fixed). So I’m starting to think that it might have been a server vulnerability on GoDaddy’s part. Or they just have no clue of how the attack happened.

    Hi Mmaunder,

    After updating to 3.5.1, I’m still getting “File Modified” warnings about the following plugins:

    1. Akismet — 4 different files
    2. WP Super Cache — readme.txt
    3. TimThumb Vulnerability Scanner — cg-tvs-timthumb-latest.txt

    I know I have the latest versions of the plugins, especially Akismet, as I have just updated it.

    By the way, I LOVE Wordfence and thank you so much for such wonderful security plugin! It’s on my must-have WP security checklist!

    @cgw — thanks for the additional info here and on the other thread. I have added some update over at the other thread.

    To answer your questions, my site-in-question is on GoDaddy and no, it doesn’t use Artisteer.

    Other than TimThumb, there are other “upload” scripts that can be dangerous, especially if they are outdated. Uploadify is another one you should check your themes/plugins for.

    wpsecure.net keeps database of vulnerable WP themes and plugins, you might want to cross-reference your stuff with that list.

    So I have been hounding GoDaddy for more information, since they told me they were investigating the root cause of the attack, and since the attacks (at least for me and StoneChopper) came from GoDaddy servers.

    Beside confirming that the attack on my site-in-question did came from a GoDaddy IP, here’s the latest (most thorough) info I have gotten from them so far:

    We have continued to research the root cause of this issue, however due to security concerns we are unable to provide the entire results of our findings. Attacks originated from compromised accounts on other shared hosting servers and we have taken steps to prevent these attacks from succeeding in the future. We found that in most cases a previous compromise of the account had occurred in which attackers added a new WordPress administrator user named ‘systemwpadmin’ to the WordPress database. It does not appear to be an unpublished exploit, but rather a re-visiting of previously compromised and un-cleaned accounts. The ‘systemwpadmin’ user was later used to login directly to your WordPress admin, modify files, and the user was then removed from the database. We have placed additional security measures in place to prevent this specific attack in the future. You can work to prevent this attack or similar attacks by ensuring that WordPress is fully up to date as well as all themes, plugins, etc. and that any vulnerable items are removed from your account rather than simply being disabled via WordPress.

    Well, systemwpadmin was able to get into after I had all the usual security recommendations done and then some. The only thing I can suspect is that there were some unused themes and plugins when the attack happened, so may be one of them had exploit code. Those unused themes and plugins have since been deleted, and unfortunately I didn’t make copies of them before uninstalling them, so I can’t tell for sure if they were the culprits.

    I have pleaded with GoDaddy for more information, especially info on the exploit(s) involved (if there was any). I’m also curious about what “security measures” they put in to prevent such attack in the future, but I doubt they would tell me, especially if that would expose any vulnerability of their servers. I’ll update when I hear back from them.

    Meanwhile, I came across this video that shows an exploit to add a new admin user. It applies to WP 3.3.2, but it doesn’t mean it doesn’t affect current WP version. Here’s a little more info on the exploit: link

    I’ve been researching this issue as well, and have been posting some stuff on this other thread:
    http://wordpress.org/support/topic/unknown-logged-in-successfully-as-systemwpadmin

    The current theory is that the attacker is able to remotely create an admin level user, logs into the site, does his thing (in my case, tried changing some files via the theme editor), then logs out and delete himself from the database.

    I have not completely figured out how that was being done. Someone suggested that script injections via outdated Timthumb allowed some kind of user creation script to be added to the site. So you might want to scan your site for any file changes, if you haven’t done that already. Wordfence does a good job pointing out discrepancies between your files versus WP’s original distribution. Check your theme’s functions.php for suspicious stuff too.

    A few other things I did seems to help keep the phantom user at bay:

    1. updated the salt values in wp-config.php
    2. updated my WP database password
    3. got rid of any unused themes and plugins — I suspect some kind of user creation script might have been added there in my case
    4. I use Wordfence to get alerted when admin level users login so I can better monitor who’s accessing the site.
    5. Ultimate Security Checker scans for malicious stuff in post and comments too, if you need a scanner for that.

    Will update if I find additional information.

    @shane,

    Thanks for the pointer. I actually came across the wp_create_user function while searching for code to create users remotely, but it doesn’t quite explain how the attacker was able to specify the numeric user ID (88888) to insert (instead of incrementing from existing IDs). Unless the attacker created an user first, then changes its number ID. But I don’t see the reason why he would do that, especially he was deleting the user after he was done anyways…

    Nevertheless, it’s definitely a good point about Timthumb and the theme’s functions.php. Before I took over the management of this site-in-question, it had an outdated timthumb.php. After I updated it to the latest version, the attacker actually tried to changed it (but wasn’t able to as I have other firewalls in place).

    The theme’s functions.php is, and has always been, clean, so are the rest of the core, theme and plugin files. However there were a bunch of unused themes and plugins, which I uninstalled. So it is very possible that some kind of user insert exploit code was hidden in one of those unused themes/plugins.

    Anyways, I’ll continue to research on this. Will update if I find any additional info.

Viewing 15 replies - 1 through 15 (of 38 total)