Copied to clipboard

Flag this post as spam?

This post will be reported to the moderators as potential spam to be looked at


  • Robert Valcourt 70 posts 103 karma points
    Jan 15, 2016 @ 20:04
    Robert Valcourt
    0

    Was our site hacked? Here is what we know...

    Umbraco 6.1.6. Today we woke to find that our site was offline. The backoffice was working so I logged in. All content nodes were present. When clicked to load they displayed the usual "Object reference not set to an instance of an object" message. In the settings section, all the doctypes and templates are gone. I then logged in via FTP. I go into the masterpages folder and all the templates are there except the master. This is strange.

    Got RDP access to server and logged into MS SQL Management Studio. Checked the dbo.cmsTemplate table. This is what I found:

    Master template SHOULD have values of:

    nodeId: 1045 master: NULL alias: master design: (various HTML code)

    This is what I actually saw:

    nodeId: 1045 master: 1044 (there is no template with nodeId 1044) alais: test design: test

    When I check the masterpages folder there is indeed a test.master file. All it had was the word 'test' in it. The masterpages folder DID still have all the child templates though. To restore the site I did this:

    In SQL Management I went into table editing mode. I change the 'master' value from 1044 to NULL and changed the alias to what it was supposed to be. Rebooted the site. Now in Umbraco the Test template is visible and I renamed it to Master. All the child templates reappeared as well as the doctypes. I found my HTML from a backup and put it back in the template. Nodes are now editable and publishable.

    I'm now wondering what could have done this. Deleting a template via backoffice would not have had this effect nor renaming templates via FTP or RDP. This seem to have been a direct SQL change.

    Can anyone shed light on this? I fear the site is somehow insecure ... or maybe just some Umbraco bug. Noone made any changes to the site for the past 3 or 4 days. The test.master file had a datestamp of 12:26am this morning. Please and thank you.

  • Robert Valcourt 70 posts 103 karma points
    Feb 01, 2016 @ 23:06
    Robert Valcourt
    0

    Bumping, hoping to get some community feedback.

Please Sign in or register to post replies

Write your reply to:

Draft