13 replies to this topic

[DunWeb]

Here is the scenario for everyone to imagine. I say imagine because I can't find ANY possible reason for this to happen. There is no CRON job, or SQL trigger causing this. This website was created by me and there is no malicious code or malware.

So, the client uploads his more than 20,000 products to the database. All is good. However, within the next 48 hours or so, the products table is deleted. The products_options,product_option_values, products_description, products_to_categories etc etc are NOT deleted. JUST the products table, leaving the site seemingly without products to sell.

Has ANYONE ever heard of this or could anyone offer a suggestion where to look to correct this issue ?

This is an Apache server running PHP 5.2.1 with MySQL 5.0



Chris

[Dan Cole]

DunWeb, on 17 November 2011, 06:17, said:

Has ANYONE ever heard of this or could anyone offer a suggestion where to look to correct this issue ?
Chris

Anything in the logs that might give you a hint Chris?

Dan

[geoffreywalton]

I did have a client in Denmark where the host was deleting php scripts, because they thought they were malicious, every morning.

As the table is deleted and not truncated you can't find the time it happened as the time stamp on the table is not available.

Turn on logging and see the time errors start occurring

Then see if there is a suspicious access being made.

Also have you looked for sql in the db?

Food for thought.

G

[DunWeb]

Hello,

Thank you for the responses.

To clarify, as I did say DELETE. The products table is actually being TRUNCATED, not deleted and the error log is not showing anything.



Chris

[multimixer]

You could try to find out if the reason is "internal" (something in files/db of the store) or external (eg the host/some access) by installing the same store onto another sever to see what will happen

[DunWeb]

Hi George,

Thanks for the reply, I did install it on my development server without any problems. So, I checked with the hosting provider and they say it is nothing on their end. The site is clean and fully functional other than the products table issue. I am completely at a loss.


Chris

[multimixer]

What if you rename he products table to eg my_products (+ in the database_tables.php files) will it stay there till tomorrow?

Is the host the usual one you cooperate with? Or a clients choice?

[geoffreywalton]

If it is a truncate the table will have the time last updated which might help pin it down

G

[DunWeb]

George,

The host is the clients choice, the support is adequate but there is no way of currently tracking this issue. There doesn't seem to be any set time-frame for this occurrence, sometimes it is 4 hours, sometimes it is 2 days.

Have you ever heard of this issue with osCommerce ?

Chris

[DunWeb]

hi Geoffrey,

I can see exactly what time the table was truncated, unfortunately that's all I can see. There is no error in the log and no error on the website. When the products are loaded, the site operates normally, sales are made and recorded and the customer gets their download link to download the product. This site was functioning on another hosting account and although there were issues with that hosting provider, the database was not a problem then.

I even created a new database for the website thinking the old database was bad, but the problem persists.



Chris

[multimixer]

Having the time the table got truncated, you could check if at the same time, there was any suspicious access to the site, that was Geoffrey's idea.

I really have no idea, most suspicious is the host himself, but again, for what reason should he be deleting a single table from he DB?

Chris, I have no idea .....

[DunWeb]

Thanks for the input George. I have exhausted all reasonable explanations for this issue. As of right now, I have add ONE single product and I am monitoring the database to see if/when it gets deleted.


Thank you everyone for the input. (it makes me feel better that I am not ACTUALLY going insane..... yet ! )



Chris

[geoffreywalton]

If there is an access at the time of the truncate have a look at all the db records that are displayed and view the source of the page.

G

[MrPhil]

multimixer, on 17 November 2011, 17:56, said:

I really have no idea, most suspicious is the host himself, but again, for what reason should he be deleting a single table from he DB?

Could the product data contain words or phrases that violate the law or Terms of Service? The host might delete without comment if they find such things. I don't know if they would go in through MySQL or directly erase/empty database files (tables). Anyway, that's an angle to ponder. Are uncompressed backups (.sql files) kept on the server too, but are not molested?

Otherwise, I would suspect the client is being hacked somewhere. From a clean PC (spyware scanned) change all the passwords you can think of, and see if the problem re-occurs. Look at all PHP code for suspiciously encoded strings.