Zen Cart Logo
Forums / Reports of Security Problems / Possible SQL Insertion?

Possible SQL Insertion?

Views: 12

Results 1 to 2 of 2
31 Oct 2012, 22:07
#1
late_landing avatar

late_landing

New Zenner

Join Date:
Nov 2011
Location:
New Zealand
Posts:
9
Plugin Contributions:
0

Possible SQL Insertion?

Hi,

I am not sure if this is a hack attempt or not.

I went into the Admin and 'administer my SQL with PHPMy Admin' and found there is a new SQL database called 'mysql'. I don't recall seeing this 'mysql' before today and I do back-up weekly. In this new 'mysql' is a table for 'user' and I find my admin details correctly there but showing as two separate line entries one with full admin privilages and the other with no privilages. In the 'user' table there is also another line showing host as 127.0.0.1 with a user name the same as mine but showing no password and giving full admin privilages.

I have looked at my shops SQL database (named shb_zen5) and find no access by unauthorized IP addresses under the admin_activity_log.

Is this a SQL insertion and should I be worried as there appears to be no password shown for access.

Zen version 1.5.0
Upgraded by me from Zen 1.3.8 which had been upgraded with the anti hacking upgrades.
I upgraded as per the Zen instructions using zen-install.
Add-ons installed are: avonlee_contempory_1.3 template , confirm_email_address_1.3a , Monthly Sales and Tax Summary Report , Pay By Phone , Sales Report 1.5.0 , Time Zone Fix , UK-Data-Format , ZC Inventory Report , zen_lightbox-v1.6.4_1.20120428 .
No obvious changes to site layout has been observed http://www.sugarcrafthawkesbay.co.nz
Hosting company is Melbourne IT, Australia through the services of Telecom New Zealand - Business Hub.
No upgrades or mods in the past month.

07 Nov 2012, 04:39
#2
drbyte avatar

drbyte

Sensei

Join Date:
Jan 2004
Posts:
63,513
Plugin Contributions:
177

Re: Possible SQL Insertion?

The 'mysql' database is a system database handled and administered by the MySQL database engine itself. You don't need to make backups of it, and you should not be editing anything in it.

The existence of that database is neither a security problem nor anything to be alarmed at. Indeed it's probably been there all along. If you didn't see it before then maybe it's now showing simply because your hosting company's server administrator updated permissions so that you could see it. You can contact them if you have more questions about it.