Security and privacy

 
 
Picture of Alan Hess
SQL Injectable Sites listed!
Group Particularly helpful Moodlers

Hi

This website lists my open Moodle 1.9 site amongst many others as 'SQL injectable' - http://pastebin.com/sqcPer25  !!!

OK, I know 1.9 is no longer supported, but I have a lot of content already indexed in search engines and don't have time to completely upgrade the site just yet.

Is there anything I can do? Nothing seems to have happened yet, thank goodness.

One thought. If I dump the MYSQL database and convert to POSTGRES, would that be safer?

Regards

Alan

 

 

 
Average of ratings: -
Tim at Lone Pine Koala Sanctuary
Re: SQL Injectable Sites listed!
Group DevelopersGroup Documentation writersGroup Particularly helpful Moodlers

Are you running 1.9, or 1.9.19+?

 
Average of ratings: -
Picture of Alan Hess
Re: SQL Injectable Sites listed!
Group Particularly helpful Moodlers

Hi Tim

Thanks for replying. Site is Moodle 1.9.19+ (Build: 20120831) i.e. latest download.  I'd upgrade to 2, but it's too much work for just now and there are others relying on the site.

Regards

 
Average of ratings: -
Tim at Lone Pine Koala Sanctuary
Re: SQL Injectable Sites listed!
Group DevelopersGroup Documentation writersGroup Particularly helpful Moodlers

Well, then you are reasonably safe. The problem with SQL injection is that, if it is exploited you can lose the whole database. The original listing of exploitable sites seems to have been taken down, which is good. Did it gave explicit instructions for how to exploit your site? If not, then it does not mean much.

 
Average of ratings: -
Picture of Alan Hess
Re: SQL Injectable Sites listed!
Group Particularly helpful Moodlers

Hi Tim

I contacted  'pastebin' and asked them to remove the page. Seems to have worked!

As I backup the DB via Webmin often, I suppose I'm safe. After all, there are loads of sites using Joomla, Moodle etc.. that are based on LAMP out there.

Just out of interest, I see loads of 'hammer' style attacks on my site in logs. I normally ask my provider to ban the specific IP with .htaccess and they do this for me quite promptly.

BTW: A colleague of mine with an old version of Moodle 1.8 and an unfriendly ISP got totally hacked a couple of years ago.

Regards

 
Average of ratings:Useful (1)