Question

I ran into some trouble modifying my product and reinstalling it, so I tried installing the version I know works on my live site.

Still no love, just an error message I can’t decipher which seems to contain spam! Any suggestions as to how I can diagnose this or where to seek help?

This pastie has the error, truncated due to size:
http://www.pastie.org/2715995

Come to think of it I did see an unidentified user listed at one stage…

Thanks!

Answer 1

Most likely, your site has been compromised by an automated script exploiting CVE-2011-2528. The script adds accounts, changes passwords of existing accounts, and customizes your main_template macro.

In order to clean this up, you need to:

1. Install the Plone Hotfix.
2. Reset your session secrets to prevent reuse of old session cookies the attacker may still have.
3. Audit the accounts present, removing any you do not know, especially if they Administrator access.
4. Clean up your main_template macro. If you never customized it through the web, simply delete it from your portal_sites/custom folder (go to the ZMI, select portal_sites, select custom, and delete), otherwise edit it and remove the hidden links at the bottom.