Security

Hi,

I got an email from my server with this message:

Subject: -  security attack was stopped!

Total impact: 5
Affected tags: xss, csrf

Variable: COOKIE.memberSession | Value: 5DLGPwfD!teU7FBYzPa=Fc/i+h5uZQrs
Impact: 5 | Tags: xss, csrf
Description: Detects obfuscated JavaScript script injections | Tags: xss, csrf | ID: 25
Centrifuge detection data  Threshold: 3.49  Ratio: 1.24

REMOTE_ADDR: 86.47.113.202
HTTP_X_FORWARDED_FOR:
HTTP_CLIENT_IP:
SCRIPT_FILENAME: /var/www/vhosts/mysite.com/httpdocs/social/flash/XML.php
QUERY_STRING: module=im&action=updateInvite&recipient=1&_t=1279813390387
REQUEST_URI: /social/flash/XML.php?module=im&action=updateInvite&recipient=1&_t=1279813390387
QUERY_STRING: module=im&action=updateInvite&recipient=1&_t=1279813390387
SCRIPT_NAME: /social/flash/XML.php
PHP_SELF: /social/flash/XML.php

Any ideas?

Glenn

http://www.boonex.com/unity/forums/#topic/Troubleshooting-Possible-Security-Attacks-.htm

should help you quite a bit

Hi,

Thanks for the reply.

I have just noticed something!!!

My impact is 5. I set my threshold/s to 5 - I got 600 emails in 1 minute.

I set it back to -1 - emails stopped.

However my whole VPS has slowed down (Other sites as well).

I checked my server resources - CPU= 80-100%

It was normally 1-5 %

Please help - I love the script - but what is happening to my server?

Glenn

You must be running an earlier version of Dolphin to be getting these emails. These settings should be at -1 to stop the emails. Clear your /cache (except .htaccess) and the /cache_public

Hi,

Help please - CPU at 80-100% - something is wrong with the site - Only had the script installed for 1 day.

Glenn

Does your control panel have some form of process monitoring that you can look at?

Hi,

I am running version 7.2. Latest download.

It is not the emails - I have set it back to -1.

All my sites are slower and CPU on VPS is spiking.

Was fine before installing Dolphin?

Any way to find the problem

Regards

Glenn

If you don't have the ability to view what's causing the resource spike (like a particular file), contact your web hosting provider and see if they can figure out which file is misbehaving. It may do some good to disable the cron job in the mean time.

Hi,

Thanks for the feedback, I am doing a clean install to the top level of the site.

I will let you know what happens.

Thanks

Glenn

Hi - I moved to Hostforweb - site is flying like a jet - hosting plays important role.

No more issues.

Regards

Glenn