adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-30 21:52:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

Piwigo pwned by viagra resellers #747

New Issue
Closed
opened 2026-10-05 00:15:16 +02:00 by adam · 14 comments
adam commented 2026-10-05 00:15:16 +02:00
Owner
Copy link
Copy source

We just discovered this : https://agir.april.org/issues/2861

We are not alone : https://www.google.fr/search?q=cialis-5mg-prix-pharmacie+piwigo https://www.google.fr/search?q=viagra+piwigo

_data/settings is pwned, probably for years. We still investigate where does it comes from.

We just discovered this : https://agir.april.org/issues/2861 We are not alone : https://www.google.fr/search?q=cialis-5mg-prix-pharmacie+piwigo https://www.google.fr/search?q=viagra+piwigo _data/settings is pwned, probably for years. We still investigate where does it comes from. <!-- github-sync-id:283854663 -->
adam closed this issue 2026-10-05 00:15:16 +02:00
adam commented 2026-10-05 00:15:17 +02:00
Author
Owner
Copy link
Copy source

Hello
thx for sharing
the most important would be:
-piwigo version
-list of extensions and their versions

Hello thx for sharing the most important would be: -piwigo version -list of extensions and their versions <!-- github-comment-id:353329933 -->
adam commented 2026-10-05 00:15:18 +02:00
Author
Owner
Copy link
Copy source

Not sure it is relevant, unfortunatelly. We use Piwigo for years with regular upgrades.

    Piwigo 2.9.2
    Operating system: Linux
    PHP: 5.6.30-0+deb8u1 (Show info) [2017-12-21 12:41:50]
    MySQL: 5.5.5-10.1.26-MariaDB-0+deb9u1 [2017-12-21 12:41:50]
    Graphics Library: External ImageMagick 6.9.7-4

Bad files have been mtimed up to 2016-10-28, but again, not sure it is relevant.

We use SimpleNG (default) and Smart Pocket (Mobile) themes.

We don't have any plugin activated

# ls plugins/
AdminTools  c13y_upgrade  community  Force_HTTPS  index.php  language_switch  LocalFilesEditor  TakeATour
Not sure it is relevant, unfortunatelly. We use Piwigo for years with regular upgrades. ``` Piwigo 2.9.2 Operating system: Linux PHP: 5.6.30-0+deb8u1 (Show info) [2017-12-21 12:41:50] MySQL: 5.5.5-10.1.26-MariaDB-0+deb9u1 [2017-12-21 12:41:50] Graphics Library: External ImageMagick 6.9.7-4 ``` Bad files have been mtimed up to 2016-10-28, but again, not sure it is relevant. We use SimpleNG (default) and Smart Pocket (Mobile) themes. We don't have any plugin activated ```bash # ls plugins/ AdminTools c13y_upgrade community Force_HTTPS index.php language_switch LocalFilesEditor TakeATour ``` <!-- github-comment-id:353331598 -->
adam commented 2026-10-05 00:15:19 +02:00
Author
Owner
Copy link
Copy source

Crappy content has been found in ../_data/settings/. What should contains this directory ?

Crappy content has been found in `../_data/settings/`. What should contains this directory ? <!-- github-comment-id:353367242 -->
adam commented 2026-10-05 00:15:19 +02:00
Author
Owner
Copy link
Copy source

alors:
pour moi ce dossier ne sert à rien, ou est utilisé comme sauvegarde pour des extensions
il faudrait nous en donner le contenu
j'ai vu que vous aviez fait un diff sans rien trouver; quel est le détail?
quelles sont les extensions présentes, pas juste activé; faites un diff sur celle ci aussi

les urls de la recherche Google sont étonnantes et sont de trois types: /index.php?product=xxx /index.php?q=xxxx et index.php?p=xxxx ou encore id=xxx. Aucunes n'existent au sein de piwigo et semblent forgées

J'ai tenté d'accéder au _data/settings/ de plusieurs galeries concernées mais 404 alors que la redirection est présente.

Avec le timing je pense qu'on regardera après les vacances

alors: pour moi ce dossier ne sert à rien, ou est utilisé comme sauvegarde pour des extensions il faudrait nous en donner le contenu j'ai vu que vous aviez fait un diff sans rien trouver; quel est le détail? quelles sont les extensions présentes, pas juste activé; faites un diff sur celle ci aussi les urls de la recherche Google sont étonnantes et sont de trois types: /index.php?product=xxx /index.php?q=xxxx et index.php?p=xxxx ou encore id=xxx. Aucunes n'existent au sein de piwigo et semblent forgées J'ai tenté d'accéder au _data/settings/ de plusieurs galeries concernées mais 404 alors que la redirection est présente. Avec le timing je pense qu'on regardera après les vacances <!-- github-comment-id:353392550 -->
adam commented 2026-10-05 00:15:20 +02:00
Author
Owner
Copy link
Copy source

First test should be to run plugin Check Files Integrity, I'm 99% sure you
will find a standard Piwigo file modified with a hack

On Thu, 21 Dec 2017 at 17:19, flop25 notifications@github.com wrote:

alors:
pour moi ce fichier ne sert à rien
il faudrait nous en donner le contenu
j'ai vu que vous aviez fait un diff sans rien trouver; quel est le détail?
quelles sont les extensions présentes, pas juste activé; faites un diff
sur celle ci aussi

les urls de la recherche Google sont étonnantes et sont de trois types:
/index.php?product=xxx /index.php?q=xxxx et index.php?p=xxxx . Aucunes
n'existent et semblent forgées

J'ai tenté d'accéder au _data/settings/ de plusieurs galeries concernées
mais 404 alors que la redirection est présente.

Avec le timing je pense qu'on regardera après les vacances

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

--
Pierrick LE GALL

First test should be to run plugin Check Files Integrity, I'm 99% sure you will find a standard Piwigo file modified with a hack On Thu, 21 Dec 2017 at 17:19, flop25 <notifications@github.com> wrote: > alors: > pour moi ce fichier ne sert à rien > il faudrait nous en donner le contenu > j'ai vu que vous aviez fait un diff sans rien trouver; quel est le détail? > quelles sont les extensions présentes, pas juste activé; faites un diff > sur celle ci aussi > > les urls de la recherche Google sont étonnantes et sont de trois types: > /index.php?product=xxx /index.php?q=xxxx et index.php?p=xxxx . Aucunes > n'existent et semblent forgées > > J'ai tenté d'accéder au _data/settings/ de plusieurs galeries concernées > mais 404 alors que la redirection est présente. > > Avec le timing je pense qu'on regardera après les vacances > > — > You are receiving this because you are subscribed to this thread. > Reply to this email directly, view it on GitHub, or mute the thread. > -- Pierrick LE GALL <!-- github-comment-id:353874859 -->
adam commented 2026-10-05 00:15:21 +02:00
Author
Owner
Copy link
Copy source

First test should be to run plugin Check Files Integrity, I'm 99% sure you will find a standard Piwigo file modified with a hack

Executed and no alteration detected…

> First test should be to run plugin Check Files Integrity, I'm 99% sure you will find a standard Piwigo file modified with a hack Executed and no alteration detected… <!-- github-comment-id:365987080 -->
adam commented 2026-10-05 00:15:22 +02:00
Author
Owner
Copy link
Copy source

Our team found alteration in …/piwigo/local/config/database.inc.php:

create_function('',` gzuncompress(base64_decode("eAHNWntv4

This file seems be out of the scope used by the Check Files Integrity plugin.

Our team found alteration in …/piwigo/local/config/database.inc.php: > create_function('',` gzuncompress(base64_decode("eAHNWntv4 This file seems be out of the scope used by the Check Files Integrity plugin. <!-- github-comment-id:388541612 -->
adam commented 2026-10-05 00:15:23 +02:00
Author
Owner
Copy link
Copy source

Hi everybody,

We detected another attack on our Piwigo instance (uptodate, no plugin, simpleng theme).
We made a diff between our files and the downloadable version. We found some differences:

> d166d0c2aa118a049a56f18a08f727be  ./admin/include/photos_add_direct_process.inc.php
> d6e24cafa4a53a023a8def5a15717973  ./admin/include/uploadify/cancel.png
> 6e13f1471689cd229370f5323f422f9a  ./admin/include/uploadify/jquery.uploadify.v3.0.0.min.js
> 169127a55932ac7bd2bdb8438458194d  ./admin/include/uploadify/uploadify.css
> 25fbd134674c17a0b8ad48d39cbeed22  ./admin/include/uploadify/uploadifyLang_en.js
> 9f96a541a4c6d9c56b538099a49f2beb  ./admin/include/uploadify/uploadify.php
> 78331dd3b7c68ba34aa71727463417c0  ./category.php
> be77644c4a40b998e83e175217d5532a  ./convertcomments.pl
> d0b7c7fcc7ab12391faead4a27521d35  ./include/php_compat/array_intersect_key.php
> 397b2819ebe2f76c9f39c7ddbb1f832d  ./include/php_compat/hash_hmac.php
> 0e954fb2a8d35b5f0ebc2597e44d2110  ./include/php_compat/json_encode.php
> ec53710567138290df4dca9b8ff4b1fe  ./include/php_compat/preg_last_error.php
> ffaba159a9b9295d625463529cb97e4b  ./include/smarty/libs/sysplugins/smarty_config_source.php
> 762143ac566d46a23006e79b5f2a6fff  ./include/smarty/libs/sysplugins/smarty_internal_config.php
> 0f826812544232e25132593a203ef59d  ./include/smarty/libs/sysplugins/smarty_internal_filter_handler.php
> 8a49d892a04a3fbb10cca912a7487b39  ./include/smarty/libs/sysplugins/smarty_internal_function_call_handler.php
> 949832bd466c450016bff0a400a13b84  ./include/smarty/libs/sysplugins/smarty_internal_get_include_path.php
> 2b204f9318a8294bc63a17a3c79b8f37  ./include/smarty/libs/sysplugins/smarty_internal_utility.php
> c072ec6843fcf4689e746c2ea313f636  ./include/smarty/libs/sysplugins/smarty_internal_write_file.php
> b66d046d20b502819713bf9ca8c06ae4  ./local/config/default.inc.php
> 00b890eaeb5cafe6e772a6151a0f3fe0  ./template-extension/april/licence.tpl
> 6f4e20a83198078603e311a03ce5f723  ./admin/themes/clear/icon/datepicker.png
> 7933464b84f3daecd4a3b37b286c5afe  ./admin/themes/default/fix-ie5-ie6.css
> 7a5116a155a72c657a05c159e7d4c4b7  ./admin/themes/default/fix-ie7.css
> 950b1dea90e05c7534e420be74e5d029  ./admin/themes/default/icon/datepicker.png
> e91285b666969efacff8c20f9010e571  ./admin/themes/default/icon/remove_filter_hover.png
> ffb2ffe023e2017bf6f85a846ecbd024  ./admin/themes/default/icon/remove_filter.png
> 03f75be0a1d12d6ddddb52bd3c959c26  ./admin/themes/default/local_head.tpl
> 40115888897b0b136d6a1b22e7a09871  ./admin/themes/default/template/configuration.tpl
> a3aee40f7a37b62a0890d12a4f7e1865  ./admin/themes/default/template/profile_content.tpl
> 7000f5b21c00b8e22adaaf79a77099b8  ./admin/themes/default/template/profile.tpl
> 9fef40e0f3ba51a4e39655192a30543c  ./themes/clear/pem_metadata.txt
> 2430afbad2a7104db9126ee20724fa40  ./themes/dark/pem_metadata.txt
> d097ff1593eeda4b0349f8a9260f9799  ./themes/default/js/datepicker.js
> 1936585831e8bcf4eb5ef1081c8e2574  ./themes/default/js/plugins/colorbox/style1/images/ie6/borderBottomCenter.png
> 7ceeb01563f030dc47837fd8bad29488  ./themes/default/js/plugins/colorbox/style1/images/ie6/borderBottomLeft.png
> 297fb77440870d91f519bcecdb312725  ./themes/default/js/plugins/colorbox/style1/images/ie6/borderBottomRight.png
> 64df0244eeaade27764d2cf33606527b  ./themes/default/js/plugins/colorbox/style1/images/ie6/borderMiddleLeft.png
> 9fa458eaaa35b80b2452f35a1d6b4d0c  ./themes/default/js/plugins/colorbox/style1/images/ie6/borderMiddleRight.png
> 01ecb01841270f3a765aadf4900929f3  ./themes/default/js/plugins/colorbox/style1/images/ie6/borderTopCenter.png
> bf4949b95b09d255edd9bcb8358a3557  ./themes/default/js/plugins/colorbox/style1/images/ie6/borderTopLeft.png
> 51315fa19507a33d5f1b5411598593e7  ./themes/default/js/plugins/colorbox/style1/images/ie6/borderTopRight.png
> b02eebde872e7416c2315b51ed9c37f5  ./themes/default/js/plugins/colorbox/style1/index.html
> e9bdd308d0c5978e837e5aba1c5712d6  ./themes/default/js/plugins/colorbox/style2/images/controls.png.old
> b02eebde872e7416c2315b51ed9c37f5  ./themes/default/js/plugins/colorbox/style2/index.html
> c44a3deb74de1d0bef75378b3349808d  ./themes/default/js/plugins/datatables/css/demo_page.css
> ba835dab01f1b91f93f0ee4ad2de1a4b  ./themes/default/js/plugins/datatables/css/demo_table.css
> bd968116e9ade41f7ffde91bb8f6063a  ./themes/default/js/plugins/datatables/css/demo_table_jui.css
> 5bdd3692a1252b1403ddb7538d34fa8e  ./themes/default/js/plugins/datatables/css/jquery.dataTables_themeroller.css
> 574c1fdbe98e07b336aeee94514cba7f  ./themes/default/js/plugins/datatables/images/back_disabled.png
> 9d29134dd5e1c2192916ef9104dd877e  ./themes/default/js/plugins/datatables/images/back_enabled_hover.png
> 2998e23d43af7c7857149b0e725ccad6  ./themes/default/js/plugins/datatables/images/back_enabled.png
> c30dc560221bcc0645b55eff79b4741e  ./themes/default/js/plugins/datatables/images/favicon.ico
> 72ead25432b5a84031b8333aa5fbf259  ./themes/default/js/plugins/datatables/images/forward_disabled.png
> 9be5f327f16bcad317c8ad0ae92635d8  ./themes/default/js/plugins/datatables/images/forward_enabled_hover.png
> a8c664b8219ffde978db3d8308713975  ./themes/default/js/plugins/datatables/images/forward_enabled.png
> 9c287dd51872df723c35176fdcb4893d  ./themes/default/js/plugins/datatables/images/Sorting icons.psd
> 4517f1e4834e04104ce50f9cd256e76b  ./themes/default/template/include/datepicker.inc.tpl
> f36022a58c5b7df0e250d1d072f20a4a  ./themes/elegant/language/eu_ES/theme.lang.php
> 2793f2891372f55e576e95914c3c37c6  ./themes/elegant/pem_metadata.txt
> 53e7c644b052db5e0267e6f09945e27c  ./themes/smartpocket/language/eu_ES/theme.lang.php
> 6ce511f058662aa1c0e64915511ac91f  ./themes/smartpocket/pem_metadata.txt

The ./local/config/database.inc.php was infected too. The most dangerous file was ./local/config/default.inc.php. This one was requested directly on HTTP.

Extract of Apache log file:

[18/Aug/2018:14:10:16 +0200] "POST /local/config/default.inc.php HTTP/1.0" 200 198 "-" "Opera/9.80 (Windows NT 6.2; Win64; x64) Presto/2.12.388 Version/12.1"
[18/Aug/2018:14:10:16 +0200] "POST /local/config/default.inc.php HTTP/1.0" 200 234 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0"
[18/Aug/2018:14:10:17 +0200] "POST /local/config/default.inc.php HTTP/1.0" 200 273 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0"
[18/Aug/2018:14:10:17 +0200] "POST /local/config/default.inc.php HTTP/1.0" 200 342 "-" "Opera/9.80 (Windows NT 6.2; Win64; x64) Presto/2.12.388 Version/12.1"

Now, our version is exactly the same than the downloadable one (except for simpleng theme).
We hope that no more attack will come. Stay on the issue for futur news.

Hi everybody, We detected another attack on our Piwigo instance (uptodate, no plugin, simpleng theme). We made a diff between our files and the downloadable version. We found some differences: ``` > d166d0c2aa118a049a56f18a08f727be ./admin/include/photos_add_direct_process.inc.php > d6e24cafa4a53a023a8def5a15717973 ./admin/include/uploadify/cancel.png > 6e13f1471689cd229370f5323f422f9a ./admin/include/uploadify/jquery.uploadify.v3.0.0.min.js > 169127a55932ac7bd2bdb8438458194d ./admin/include/uploadify/uploadify.css > 25fbd134674c17a0b8ad48d39cbeed22 ./admin/include/uploadify/uploadifyLang_en.js > 9f96a541a4c6d9c56b538099a49f2beb ./admin/include/uploadify/uploadify.php > 78331dd3b7c68ba34aa71727463417c0 ./category.php > be77644c4a40b998e83e175217d5532a ./convertcomments.pl > d0b7c7fcc7ab12391faead4a27521d35 ./include/php_compat/array_intersect_key.php > 397b2819ebe2f76c9f39c7ddbb1f832d ./include/php_compat/hash_hmac.php > 0e954fb2a8d35b5f0ebc2597e44d2110 ./include/php_compat/json_encode.php > ec53710567138290df4dca9b8ff4b1fe ./include/php_compat/preg_last_error.php > ffaba159a9b9295d625463529cb97e4b ./include/smarty/libs/sysplugins/smarty_config_source.php > 762143ac566d46a23006e79b5f2a6fff ./include/smarty/libs/sysplugins/smarty_internal_config.php > 0f826812544232e25132593a203ef59d ./include/smarty/libs/sysplugins/smarty_internal_filter_handler.php > 8a49d892a04a3fbb10cca912a7487b39 ./include/smarty/libs/sysplugins/smarty_internal_function_call_handler.php > 949832bd466c450016bff0a400a13b84 ./include/smarty/libs/sysplugins/smarty_internal_get_include_path.php > 2b204f9318a8294bc63a17a3c79b8f37 ./include/smarty/libs/sysplugins/smarty_internal_utility.php > c072ec6843fcf4689e746c2ea313f636 ./include/smarty/libs/sysplugins/smarty_internal_write_file.php > b66d046d20b502819713bf9ca8c06ae4 ./local/config/default.inc.php > 00b890eaeb5cafe6e772a6151a0f3fe0 ./template-extension/april/licence.tpl > 6f4e20a83198078603e311a03ce5f723 ./admin/themes/clear/icon/datepicker.png > 7933464b84f3daecd4a3b37b286c5afe ./admin/themes/default/fix-ie5-ie6.css > 7a5116a155a72c657a05c159e7d4c4b7 ./admin/themes/default/fix-ie7.css > 950b1dea90e05c7534e420be74e5d029 ./admin/themes/default/icon/datepicker.png > e91285b666969efacff8c20f9010e571 ./admin/themes/default/icon/remove_filter_hover.png > ffb2ffe023e2017bf6f85a846ecbd024 ./admin/themes/default/icon/remove_filter.png > 03f75be0a1d12d6ddddb52bd3c959c26 ./admin/themes/default/local_head.tpl > 40115888897b0b136d6a1b22e7a09871 ./admin/themes/default/template/configuration.tpl > a3aee40f7a37b62a0890d12a4f7e1865 ./admin/themes/default/template/profile_content.tpl > 7000f5b21c00b8e22adaaf79a77099b8 ./admin/themes/default/template/profile.tpl > 9fef40e0f3ba51a4e39655192a30543c ./themes/clear/pem_metadata.txt > 2430afbad2a7104db9126ee20724fa40 ./themes/dark/pem_metadata.txt > d097ff1593eeda4b0349f8a9260f9799 ./themes/default/js/datepicker.js > 1936585831e8bcf4eb5ef1081c8e2574 ./themes/default/js/plugins/colorbox/style1/images/ie6/borderBottomCenter.png > 7ceeb01563f030dc47837fd8bad29488 ./themes/default/js/plugins/colorbox/style1/images/ie6/borderBottomLeft.png > 297fb77440870d91f519bcecdb312725 ./themes/default/js/plugins/colorbox/style1/images/ie6/borderBottomRight.png > 64df0244eeaade27764d2cf33606527b ./themes/default/js/plugins/colorbox/style1/images/ie6/borderMiddleLeft.png > 9fa458eaaa35b80b2452f35a1d6b4d0c ./themes/default/js/plugins/colorbox/style1/images/ie6/borderMiddleRight.png > 01ecb01841270f3a765aadf4900929f3 ./themes/default/js/plugins/colorbox/style1/images/ie6/borderTopCenter.png > bf4949b95b09d255edd9bcb8358a3557 ./themes/default/js/plugins/colorbox/style1/images/ie6/borderTopLeft.png > 51315fa19507a33d5f1b5411598593e7 ./themes/default/js/plugins/colorbox/style1/images/ie6/borderTopRight.png > b02eebde872e7416c2315b51ed9c37f5 ./themes/default/js/plugins/colorbox/style1/index.html > e9bdd308d0c5978e837e5aba1c5712d6 ./themes/default/js/plugins/colorbox/style2/images/controls.png.old > b02eebde872e7416c2315b51ed9c37f5 ./themes/default/js/plugins/colorbox/style2/index.html > c44a3deb74de1d0bef75378b3349808d ./themes/default/js/plugins/datatables/css/demo_page.css > ba835dab01f1b91f93f0ee4ad2de1a4b ./themes/default/js/plugins/datatables/css/demo_table.css > bd968116e9ade41f7ffde91bb8f6063a ./themes/default/js/plugins/datatables/css/demo_table_jui.css > 5bdd3692a1252b1403ddb7538d34fa8e ./themes/default/js/plugins/datatables/css/jquery.dataTables_themeroller.css > 574c1fdbe98e07b336aeee94514cba7f ./themes/default/js/plugins/datatables/images/back_disabled.png > 9d29134dd5e1c2192916ef9104dd877e ./themes/default/js/plugins/datatables/images/back_enabled_hover.png > 2998e23d43af7c7857149b0e725ccad6 ./themes/default/js/plugins/datatables/images/back_enabled.png > c30dc560221bcc0645b55eff79b4741e ./themes/default/js/plugins/datatables/images/favicon.ico > 72ead25432b5a84031b8333aa5fbf259 ./themes/default/js/plugins/datatables/images/forward_disabled.png > 9be5f327f16bcad317c8ad0ae92635d8 ./themes/default/js/plugins/datatables/images/forward_enabled_hover.png > a8c664b8219ffde978db3d8308713975 ./themes/default/js/plugins/datatables/images/forward_enabled.png > 9c287dd51872df723c35176fdcb4893d ./themes/default/js/plugins/datatables/images/Sorting icons.psd > 4517f1e4834e04104ce50f9cd256e76b ./themes/default/template/include/datepicker.inc.tpl > f36022a58c5b7df0e250d1d072f20a4a ./themes/elegant/language/eu_ES/theme.lang.php > 2793f2891372f55e576e95914c3c37c6 ./themes/elegant/pem_metadata.txt > 53e7c644b052db5e0267e6f09945e27c ./themes/smartpocket/language/eu_ES/theme.lang.php > 6ce511f058662aa1c0e64915511ac91f ./themes/smartpocket/pem_metadata.txt ``` The ./local/config/database.inc.php was infected too. The most dangerous file was ./local/config/default.inc.php. This one was requested directly on HTTP. Extract of Apache log file: ``` [18/Aug/2018:14:10:16 +0200] "POST /local/config/default.inc.php HTTP/1.0" 200 198 "-" "Opera/9.80 (Windows NT 6.2; Win64; x64) Presto/2.12.388 Version/12.1" [18/Aug/2018:14:10:16 +0200] "POST /local/config/default.inc.php HTTP/1.0" 200 234 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0" [18/Aug/2018:14:10:17 +0200] "POST /local/config/default.inc.php HTTP/1.0" 200 273 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0" [18/Aug/2018:14:10:17 +0200] "POST /local/config/default.inc.php HTTP/1.0" 200 342 "-" "Opera/9.80 (Windows NT 6.2; Win64; x64) Presto/2.12.388 Version/12.1" ``` Now, our version is exactly the same than the downloadable one (except for simpleng theme). We hope that no more attack will come. Stay on the issue for futur news. <!-- github-comment-id:418825000 -->
adam commented 2026-10-05 00:15:24 +02:00
Author
Owner
Copy link
Copy source

You probably should delete Menalto2Piwigo perl scripts
thats' only what you have in your apache logs?
Could you correlate date of change and http access?

You probably should delete Menalto2Piwigo perl scripts thats' only what you have in your apache logs? Could you correlate date of change and http access? <!-- github-comment-id:418826115 -->
adam commented 2026-10-05 00:15:24 +02:00
Author
Owner
Copy link
Copy source

Correlate found:

root@photos:/var/www/piwigo/local/config# stat database.inc.php 
  File: database.inc.php
  Size: 6604            Blocks: 16         IO Block: 4096   regular file
Device: fd00h/64768d    Inode: 143861      Links: 1
Access: (0644/-rw-r--r--)  Uid: (   33/www-data)   Gid: (   33/www-data)
Access: 2018-08-18 14:26:22.379729507 +0200
Modify: 2018-05-10 15:47:53.000000000 +0200
Change: 2018-08-18 14:26:21.155704153 +0200
 Birth: -

root@photos:/var/log/apache2# grep "2018:14:26:2[0123]" photos-*log
photos-access.log:213.128.89.184 - - [18/Aug/2018:14:26:20 +0200] "POST /local/config/default.inc.php HTTP/1.0" 200 8993 "-" "Opera/9.80 (Windows NT 6.2; Win64; x64) Presto/2.12.388 Version/12.1" 
photos-access.log:213.128.89.184 - - [18/Aug/2018:14:26:21 +0200] "POST /local/config/default.inc.php HTTP/1.0" 200 186 "-" "Opera/9.80 (Windows NT 6.2; Win64; x64) Presto/2.12.388 Version/12.1"
Correlate found: ``` root@photos:/var/www/piwigo/local/config# stat database.inc.php File: database.inc.php Size: 6604 Blocks: 16 IO Block: 4096 regular file Device: fd00h/64768d Inode: 143861 Links: 1 Access: (0644/-rw-r--r--) Uid: ( 33/www-data) Gid: ( 33/www-data) Access: 2018-08-18 14:26:22.379729507 +0200 Modify: 2018-05-10 15:47:53.000000000 +0200 Change: 2018-08-18 14:26:21.155704153 +0200 Birth: - ``` ``` root@photos:/var/log/apache2# grep "2018:14:26:2[0123]" photos-*log photos-access.log:213.128.89.184 - - [18/Aug/2018:14:26:20 +0200] "POST /local/config/default.inc.php HTTP/1.0" 200 8993 "-" "Opera/9.80 (Windows NT 6.2; Win64; x64) Presto/2.12.388 Version/12.1" photos-access.log:213.128.89.184 - - [18/Aug/2018:14:26:21 +0200] "POST /local/config/default.inc.php HTTP/1.0" 200 186 "-" "Opera/9.80 (Windows NT 6.2; Win64; x64) Presto/2.12.388 Version/12.1" ``` <!-- github-comment-id:418829724 -->
adam commented 2026-10-05 00:15:25 +02:00
Author
Owner
Copy link
Copy source

local/config/default.inc.php is not an expected file in Piwigo. The question is: where does it come from? (and I have no idea)

`local/config/default.inc.php` is not an expected file in Piwigo. The question is: where does it come from? (and I have no idea) <!-- github-comment-id:428104450 -->
adam commented 2026-10-05 00:15:26 +02:00
Author
Owner
Copy link
Copy source

I want to assure we care about this problem. See https://piwigo.org/forum/viewtopic.php?id=27113 and

I want to assure we care about this problem. See https://piwigo.org/forum/viewtopic.php?id=27113 and <!-- github-comment-id:428112164 -->
adam commented 2026-10-05 00:15:27 +02:00
Author
Owner
Copy link
Copy source

I made one proposal which could improve the situation: https://piwigo.org/forum/viewtopic.php?id=28889

I am also using nextcloud for example. When I run an update of this application then you get even an alert if you have an additional empty folder within the application directory. Every additional file which does not belong to the original source raises an alert while update.

I made one proposal which could improve the situation: https://piwigo.org/forum/viewtopic.php?id=28889 I am also using nextcloud for example. When I run an update of this application then you get even an alert if you have an additional empty folder within the application directory. Every additional file which does not belong to the original source raises an alert while update. <!-- github-comment-id:433206006 -->
adam commented 2026-10-05 00:15:28 +02:00
Author
Owner
Copy link
Copy source

I still don't know how the hackers modified many Piwigo installations. There is still no evidence they used a failure in Piwigo itself.

I haven't seen any report of this kind of hack for years. I'm closing this issue.

I still don't know how the hackers modified many Piwigo installations. There is still no evidence they used a failure in Piwigo itself. I haven't seen any report of this kind of hack for years. I'm closing this issue. <!-- github-comment-id:1220376968 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#747