MyBB Community Forums

I have noticed my error.log file filling up with errors that seem to suggest hackers or spammers are attempting to spread spam and are breaking MySQL queries. I'm not sure if it's SQL injection as there doesn't seem to be any attempt to create/update/delete anything. The fact it's generating an error and not working suggests MyBB is secure, but is there anything to worry about or anything I can do about this sort of thing:

Quote:<error>
<dateline>1277100288</dateline>
<script></script>
<line>0</line>
<type>20</type>
<friendly_type>MyBB SQL Error</friendly_type>
<message>SQL Error: 1064 - You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'LOWER(p.message) LIKE '% SPAMMMY URL #%' LOWER(p.messag' at line 4
Query:
SELECT p.pid, p.tid
FROM dbprefix_posts p
LEFT JOIN dbprefix_threads t ON (t.tid=p.tid)
WHERE 1=1 AND t.tid='231' AND p.visible >= '0' AND t.visible >= '0' AND t.closed NOT LIKE 'moved|%' AND ( LOWER(p.message) LIKE '% SPAMMY MESSAGE HERE - SPAMMY MESSAGE HERE %')

</message>
</error>

For understandable reasons I removed the actual spammy message from the quote. Needless to say there are URLs abound for all sorts of drugs.

Very strange I think that it are spammers that are trying to get something in your database but they seem to be failing. I would contact your host to see if they could ipban the hackers/spammers.

Its from the search page not sure what is causing the error would need to see the complete message

Could even be a plugin.

"Search Thread" type search most likely since the tid is specified.

Are there errors listed before and after this one in your logs? Since its just a SELECT query, nothing bad can happen, unless they are trying to execute commands in the message part you removed.

(2010-06-21, 08:09 PM)Bob Jansen Wrote: [ -> ]Very strange I think that it are spammers that are trying to get something in your database but they seem to be failing. I would contact your host to see if they could ipban the hackers/spammers.

Is there a way of finding the IP of the people behind this? MyBB doesn't seem to log them and there's no other error log.

(2010-06-21, 08:25 PM)Bob Jansen Wrote: [ -> ]Could even be a plugin.

I don't think I have a plugin that would affect this area. I'll check the plugins I have, though.

(2010-06-21, 08:26 PM)pavemen Wrote: [ -> ]"Search Thread" type search most likely since the tid is specified.

Are there errors listed before and after this one in your logs? Since its just a SELECT query, nothing bad can happen, unless they are trying to execute commands in the message part you removed.

All the errors are the same and I can't see any commands in the spammy parts, which is why I'm a bit puzzled.

I've put the full error log as an attachment so I don't think it should matter if it contains the spammy links.

It's spam bots incorrectly using your search form instead of a contact or post form. Spam bots just look for forms to send data to. Just ignore this.