easyhosting Posted May 25, 2011 Share Posted May 25, 2011 Hi My cron is set for 3am GMT every day, this worked OK as i got the cron reports as normal this morning, but i also received the below email From: Cron Daemon Sent: Wednesday, May 25, 2011 4:02 AM To: Me Subject: Cron php -q /home/********/public_html/******/*******/cron.php ComodoModuleData<br />agentcoupons<br />chat_ban<br />chat_conversations<br />chat_notes<br />chat_scripts<br />chat_sessions<br />chat_settings<br />chat_upload<br />chats<br />cms_page_language<br />cms_pages<br />cms_settings<br />data<br />gold_coupon_conf<br />htb_categories<br />htb_maincategory<br />htb_posts<br />htb_settings<br />info<br />internal<br />mod_cahconfig<br />mod_client_ftp<br />mod_feedbackemails<br />mod_freetrialsettings<br />mod_ipmanager<br />mod_ipmonitor<br />mod_newsletter<br />mod_serverdown<br />mod_terms<br />mod_testimonials<br />mod_trusticoconfig<br />mod_whozonline<br />mod_whozonline_settings<br />res<br />site_activitylogs<br />site_script<br />tblaccounts<br />tblactivitylog<br />tbladdonmodules<br />tbladdons<br />tbladminlog<br />tbladminperms<br />tbladminroles<br />tbladmins<br />tbladminsecurityquestions<br />tblaffcoupons<br />tblaffcouponsconf<br />tblaffcouponslanding<br />tblaffiliates<br />tblaffiliatesaccounts<br />tblaffiliateshistory<br />tblaffiliatespending<br />tblaffiliateswithdrawals<br />tblannouncements<br />tblbannedemails<br />tblbannedips<br />tblbillableitems<br />tblbrowserlinks<br />tblcalendar<br />tblcancelrequests<br />tblclientgroups<br />tblclients<br />tblclientsfiles<br />tblconfiguration<br />tblcontacts<br />tblcredit<br />tblcurrencies<br />tblcustomfields<br />tblcustomfieldsvalues<br />tbldmcamanager<br />tbldomainpricing<br />tbldomains<br />tbldomainsadditionalfields<br />tbldownloadcats<br />tbldownloads<btblemailtemplates<br />tblfraud<br />tblgatewaylog<br />tblgeoip<br />tblhosting<br />tblhostingaddons<br />tblhostingconfigoptions<br />tblinvoiceitems<br />tblinvoices<br />tblknowledgebase<br />tblknowledgebasecats<br />tblknowledgebaselinks<br />tbllinks<br />tblnetworkissues<br />tblnotes<br />tblorders<br />tblpaymentgateways<br />tblpricing<br />tblproductconfiggroups<br />tblproductconfiglinks<br />tblproductconfigoptions<br />tblproductconfigoptionssub<br />tblproductgroups<br />tblproducts<br />tblpromotions<br />tblquoteitems<br />tblquotes<br />tblregistrars<br />tblservergroups<br />tblservergroupsrel<br />tblservers<br />tblsslorders<br />tbltax<br />tbltestimonials<br />tbltestimonialsconf<br />tbltestimonialsquestions<br />tblticketbreaklines<br />tblticketdepartments<br />tblticketescalations<br />tblticketlog<br />tblticketmaillog<br />tblticketnotes<br />tblticketpredefinedcats<br />tblticketpredefinedreplies<br />tblticketreplies<br />tbltickets<br />tblticketspamfilters<br />tblticketstatuses<br />tbltodolist<br />tblupgrades<br />tblverificationdata<br />tblwebpages<br />tblwhoislog<br />twitpost<br />whmcsbb_faq<br />whmcsbb_follow<br />whmcsbb_forum<br />whmcsbb_group<br />whmcsbb_message<br />whmcsbb_poll<br />whmcsbb_pollentries<br />whmcsbb_pollvotes<br />whmcsbb_post<br />whmcsbb_settings<br />whmcsbb_thread<br />whmcsbb_userclass<br /> 0 Quote Link to comment Share on other sites More sharing options...
sparky Posted May 25, 2011 Share Posted May 25, 2011 A full list of your DB tables... doesn't look good Hope you have changed your DB passwords and also your root mysql password!! Check your access logs as if the cron was supposed to run at 3am it should have been well finished by 4am You do have suhosin and mod_security installed don't you. It looks like it could be a possible sql injection attempt. 0 Quote Link to comment Share on other sites More sharing options...
easyhosting Posted May 25, 2011 Author Share Posted May 25, 2011 A full list of your DB tables... doesn't look goodHope you have changed your DB passwords and also your root mysql password!! Check your access logs as if the cron was supposed to run at 3am it should have been well finished by 4am You do have suhosin and mod_security installed don't you. It looks like it could be a possible sql injection attempt. Steve - yes all passwords have been changed, the cron job did run at 3am as i received all the standards reports as normal yes i have suhosin and mod_security installed 0 Quote Link to comment Share on other sites More sharing options...
easyhosting Posted May 25, 2011 Author Share Posted May 25, 2011 access logs for the site at that time are 208.115.111.71 - - [25/May/2011:03:46:24 +0100] "GET /robots.txt HTTP/1.1" 200 56 "-" "Mozilla/5.0 (compatible; Ezooms/1.0; ezooms.bot@gmail.com)" 69.28.58.2 - - [25/May/2011:04:02:40 +0100] "GET /js/jquery.cycle.all.min.js HTTP/1.1" 406 372 "-" "Wget/1.9+cvs-stable (Red Hat modified)" 38.101.148.126 - - [25/May/2011:04:04:02 +0100] "GET /clients/forum.php?act=group&gid=4 HTTP/1.1" 406 372 "-" "Mozilla/5.0 (compatible; discobot/1.1; +http://discoveryengine.com/discobot.html)" 0 Quote Link to comment Share on other sites More sharing options...
expandmind Posted May 25, 2011 Share Posted May 25, 2011 According to Matt: That's just the output as the DB tables are being backed up. You can set the cron notification email inside cpanel to "nobody" to disable that. Ready more here: http://forum.whmcs.com/showthread.php?t=38530 0 Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.