Forum

Thread tagged as: Question, Problem, Error

New Regions showing up in Admin which are VERY strange - Please Advise

Hello,

I have used the two Language approach as presented in the Docs/Solutions which means in the Admin each Page has two Regions, one for Language A and one for Language B.

New Regions are though showing up in the Admin which make me worried.. somewhere between 30-40 new Regions to each Page...

For Example the new Regions have names like (Inhalt is the name I gave, everything in the name after Inhalt is not from me):

Inhalt - ../../../../../../../../../../etc/passwd Inhalt - en?lang=en Inhalt - 999999.9 union all select 0x31303235343830303536-- Inhalt - 999999.9 union all select 0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343 Inhalt - en union all select null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null-- Inhalt - https://www.fisheries.go.th/if-phrae/web2/images/4.txt? Inhalt - en and(select 1 from(select count(),concat((select (select concat(0x7e,0x27,unhex(Hex(cast(database() as char))),0x27,0x7e)) from information_schema.tables limit 0,1),floor(rand(0)2))x from information_schema.tables group by x)a) and 1=1

The list goes on and on. Is this an attack? A virus? This is on a Server from 1und1.de

I set the Website up in 2013/14. now I have been asked to make it Responsive so I need to takle this Problem first.

I am not suggesting that this is from Perch, just hoping someone has maybe an idea what could be causing this.

Thank you!
Matthew Owen

Matthew Owen 0 points

  • 5 years ago
Drew McLellan

Drew McLellan 2638 points
Perch Support

5 years ago

It's just bots fishing for exploits - but it looks like you're not properly escaping your input.

Can you show us the code you're using for setting the language?
Matthew Owen

Matthew Owen 0 points

5 years ago

here is an example of the code:

<?php if ($lang == 'en'){ include("inc/00_menu_en.php"); } else { include("inc/00_menu.php"); } ?>
Matthew Owen

Matthew Owen 0 points

5 years ago

and here is the code added to top of page.

<?php session_start(); if (isset($_GET['lang']) && $_GET['lang']!='') { $lang = $_GET['lang']; $_SESSION['lang'] = $lang; }elseif (isset($_SESSION['lang'])){ $lang = $_SESSION['lang']; }else{ // default language $lang = 'de'; } ?>

This looks very different to the code in the Solutions article.
Drew McLellan

Drew McLellan 2638 points
Perch Support

5 years ago

I can't really tell anything from that. I would look for $lang being populated from direct input and then concatenated into a region key.
Matthew Owen

Matthew Owen 0 points

5 years ago

Ok, would this code be what you are meaning...

<div id="contentwrapper"><!-- 980px Width -->
            <div id="fotoholder">
                <?php include("inc/01_hotel_slider.php");?>
            </div>

            <div id="contentholder">
                <?php include("inc/00_logoline.php");?>

                <div id="textfield">
                    <?php perch_content('Textfeld - '.$lang); ?><!-- Here -->

                </div>
            </div>
        </div>
Drew McLellan

Drew McLellan 2638 points
Perch Support

5 years ago

Yes, this would be the problem:

$lang = $_GET['lang'];

You should only set $lang to a known safe value.

https://solutions.grabaperch.com/architecture/how-do-i-create-a-multilingual-site