[Solved]: Can't save new configuration

[ullielfan]

Everytime I click on "save new configuration", it just leads me to a strange page and doesn't save any changes. Here is the source codes of that page.

Code Select Expand



<form action='/pix/admin.php' method='POST'><input type='text' name='login'><br/><input name='pass' type='password'><br /><input type='submit' value='authenticate'></form>



Coppermine version is 1.4.19 , gallery url is http://www.j-marsden.com/pix

[Nibbler]

You need to update to 1.4.20. That will probably fix this issue also.

[ullielfan]

Upgraded to 1.4.20 with modpack 1.4.19, but the problem still remains.

[czyrkr]

I have the same problem.

Few days ago I realized that my web site was hacked. I found some hidden files and hidden text in my cpg. I was running version 1.4.14 . I couldn't save new configuration. Now I updated to version 1.4.20 and I still cannot save configuration. It just sends me to Authentication page where I enter my Login info and.... Noting happens I get blank page admin.php. When I refresh it takes me back to admin.php which is that same configuration file but with the same configuration as before. Any help or suggestions will be appreciated.

[Aeronautic]

Upgraded to 1.4.20 with modpack 1.4.19, but the problem still remains.

I may be completely wrong here but I think modpack is version specific. By adding modpack 1.4.19 after you upgraded to cpg 1.4.20 you overwrote some of those upgraded files with files of the same name but earlier version.

Devs?

[ullielfan]

I noticed something like

Code Select Expand

<?php /**/eval(base64_decode(...... has been written into my config.inc.php file. Just deleted it, and my gallery seems to work fine now.

[czyrkr]

Code Select Expand

<?php /**/eval(base64_decode(......
Yes that was the case with my gallery as well. It works now. Thank you.

[Joachim Müller]

Means that you have been subject of a hacking attempt. Clear your gallery thoroughly - just cleaning include/config.inc.php might not be enough, the attacker might have left other payload or backdoors behind!

[czyrkr]

Means that you have been subject of a hacking attempt. Clear your gallery thoroughly - just cleaning include/config.inc.php might not be enough, the attacker might have left other payload or backdoors behind!

What is your suggestion? Should I delete all files and reinstall the whole gallery?

[Fabricio Ferrero]

What is your suggestion?

Read: Yikes, I've been hacked! Now what?

[Joachim Müller]

Should I delete all files and reinstall the whole gallery?

No.

Read: Yikes, I've been hacked! Now what?

Exactly! The only recommended solution is being explained in that thread.

[thehau]

I decoded the string and it came up with something from joomla, which I did install. 

[thehau]

Sorry hit Post too early.

Good news is that my site hasn't been compromised, a good online base64 decoder is here:

http://www.motobit.com/util/base64-decoder-encoder.asp

On the safe side, I did upgrade to the latest version of coppermine.

[Joachim Müller]

Locking