[Systems] File alteration in sunjammer (was: Re: Somosazucar.org blog victim to SQL injection?)

[Sebastian Silva]

Hello all,

So finally I spent some time trying to fix this.

There was nothing wrong with the database, but the file 
wp-includes/functions.php was corrupted. There was a part of itself 
appended to the end of the file.

I doubt anyone else wrote to it, nor had I even ever opened this file.
I suspect maybe there was filesystem corruption? I don't know how this 
might have come to pass.

Anyone have a theory?

Regards.
Sebastian




El sáb, 4 de jul 2015 a las 12:26 AM, Sebastian Silva 
<sebastian at fuentelibre.org> escribió:
> I've examined the SQL database and couldn't find anything suspicious 
> on
> a first pass.
> 
> Perhaps it is something else.
> 
> On 04/07/15 00:05, Sam P. wrote:
>>  Wait, why are you so sure this is SQL injection?
> 
> --
> I+D SomosAzucar.Org
> "icarito" #somosazucar en Freenode IRC
> "Nadie libera a nadie, nadie se libera solo. Los seres humanos se 
> liberan en comunión" - P. Freire
> 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.sugarlabs.org/private/systems/attachments/20150716/d1841ba5/attachment.html>