0

Till about an hour ago my Drupal 7 site was working fine. But now when I access the login page (/user) I get an You are not authorized to access this page

So I checked the node_access table and I see a record for anonymous users - 0 0 all 1 0 0

I checked the sessions table and it didn't seem to be corrupted. But nevertheless cleared the records. But I am still unable to access the login page

The last time we applied a module update was 10 days back so I don't think its got to do anything with the module code written by us.

I am at my wits end! Have anyone of you faced a similar issue?

EDIT 21st Oct 2014 : A link that explains the exploit - is here

Improve this question
9
  • Depending on the Drupal version you are on there was a severe anonymous hack. We had the same issue on one of our sites where I work. We looked into the database tables and noticed that the menu_router table had access callback changed for the user entry. I would start looking there.
    – FatGuyLaughing
    Oct 20, 2014 at 14:08
  • We are finding out that there are more injections in the tables... not just on the /user menu_router. If I were you, I would restore my database from a backup file. Hopefully you have a nightly backup of your database.
    – FatGuyLaughing
    Oct 20, 2014 at 14:13
  • I found that the menu_router table had the access_callback set to php_eval for the /user path. Updated it to 1.
    – sridhar pandurangiah
    Oct 20, 2014 at 14:24
  • I have a backup of 15th Oct. Restoring it and comparing the Drupal tables
    – sridhar pandurangiah
    Oct 20, 2014 at 14:30
  • I just confirmed with the operations team and this is also what they had found. However, they found it in more tables besides the menu_router table. So if you have a backup that you can go do without losing a lot of data; That would be the way to go.
    – FatGuyLaughing
    Oct 20, 2014 at 14:31

1 Answer 1

Reset to default
1

You are logged in, and need to logout.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.