0

Till about an hour ago my Drupal 7 site was working fine. But now when I access the login page (/user) I get an You are not authorized to access this page

So I checked the node_access table and I see a record for anonymous users - 0 0 all 1 0 0

I checked the sessions table and it didn't seem to be corrupted. But nevertheless cleared the records. But I am still unable to access the login page

The last time we applied a module update was 10 days back so I don't think its got to do anything with the module code written by us.

I am at my wits end! Have anyone of you faced a similar issue?

EDIT 21st Oct 2014 : A link that explains the exploit - is here

  • Depending on the Drupal version you are on there was a severe anonymous hack. We had the same issue on one of our sites where I work. We looked into the database tables and noticed that the menu_router table had access callback changed for the user entry. I would start looking there. – FatGuyLaughing Oct 20 '14 at 14:08
  • We are finding out that there are more injections in the tables... not just on the /user menu_router. If I were you, I would restore my database from a backup file. Hopefully you have a nightly backup of your database. – FatGuyLaughing Oct 20 '14 at 14:13
  • I found that the menu_router table had the access_callback set to php_eval for the /user path. Updated it to 1. – sridhar pandurangiah Oct 20 '14 at 14:24
  • I have a backup of 15th Oct. Restoring it and comparing the Drupal tables – sridhar pandurangiah Oct 20 '14 at 14:30
  • I just confirmed with the operations team and this is also what they had found. However, they found it in more tables besides the menu_router table. So if you have a backup that you can go do without losing a lot of data; That would be the way to go. – FatGuyLaughing Oct 20 '14 at 14:31
1

You are logged in, and need to logout.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.