Bug, server issue or attempted hack?

[Carsafety]

This new error message appeared a half dozen times over a 30 minute period overnight. I'd never seen it before. Is it anything for concern? Each time the email notification listed "Username: Unregistered". Unregistered users are allowed to post on one of our forums, though they are moderated and image verification is enabled.

"Invalid SQL:

CREATE TABLE IF NOT EXISTS scwho (
ID INT UNSIGNED PRIMARY KEY NOT NULL AUTO_INCREMENT,
USERNAME CHAR(255),
SUBROOM CHAR(255),
HIDDEN INT UNSIGNED,
UID INT UNSIGNED,
ADMIN INT UNSIGNED);

MySQL Error : Can't create/write to file './carseat_vbcarseat/scwho.frm' (Errcode: 13)
Error Number : 1
"

[Boxy]

MySQL Error :
Can't create/write to file ./carseat_vbcarseat/scwho.frm' (Errcode: 13)

MySQL Error: Permission denied
The directory listed in that error either does not exist, or it is not world-readable and writable (chmod 777.) You need to check and correct both situations to fix this error.

You would need to contact your host to have this resolved. Restarting mysql might already solve this problem.

[Carsafety]

MySQL Error :
Can't create/write to file ./carseat_vbcarseat/scwho.frm' (Errcode: 13)

MySQL Error: Permission denied
The directory listed in that error either does not exist, or it is not world-readable and writable (chmod 777.) You need to check and correct both situations to fix this error.

You would need to contact your host to have this resolved. Restarting mysql might already solve this problem.

Well, the problem happened overnight over a 30 minute period. It has not happened before, hasn't happened since and I have made no recent changes to Vbulletin or any file or server settings. That's why I thought it was unusual. If it wasn't some kind of hacking attempt by someone who wasn't registered, then whatever the issue was seems to have resolved itself. Thanks!

[Steve Machol]

vB does not have a table named 'scwho' so this is not a vB error.

However this is a known problem with MySQL version 4.1.21. If your host is running that version then ask them to upgrade.

[Carsafety]

vB does not have a table named 'scwho' so this is not a vB error.

However this is a known problem with MySQL version 4.1.21. If your host is running that version then ask them to upgrade.

My cpanel says 4.0.27-standard . Same for that version?

[Steve Machol]

That's good. But it's still a permissions problem on a non-vB table. If this continues you need to contact your host.

[Paul M]

There is nothing in vbulletin that will attempt to create a table like that - you really need to post the full error e-mail as it shows what script was used. Without more information it looks like someone may have been trying to use an exploit to create a mysql table.

[Carsafety]

There is nothing in vbulletin that will attempt to create a table like that - you really need to post the full error e-mail as it shows what script was used. Without more information it looks like someone may have been trying to use an exploit to create a mysql table.

Sorry I thought I posted the relevant bits. Here is the first one in its entirety:

"Database error in vBulletin 3.6.2:

Invalid SQL:

CREATE TABLE IF NOT EXISTS scwho (
ID INT UNSIGNED PRIMARY KEY NOT NULL AUTO_INCREMENT,
USERNAME CHAR(255),
SUBROOM CHAR(255),
HIDDEN INT UNSIGNED,
UID INT UNSIGNED,
ADMIN INT UNSIGNED);

MySQL Error : Can't create/write to file './carseat_vbcarseat/scwho.frm' (Errcode: 13)
Error Number : 1
Date : Tuesday, February 6th 2007 @ 04:13:34 AM
Script : http://www.car-seat.org/showthread.php?t=11203
Referrer :
IP Address : 74.6.71.177
Username : Unregistered
Classname : mydatabase"

Note that I have patched to 3.6.4. My Vbulletin is essentially stock, but I do have one plugin addon- Addonchat.

I just had a chance to check the IP addresses for the 5 messages. Assuming they weren't forged, 4 of them appear to be from Inktomisearch and the other seems to be from Googlebot.

Maybe there was a server glitch early this morning and the only ones surfing at the time were search engines...

[Steve Machol]

That is NOT a vB table, hence the error message is related to an add-on and not vB.

And besides we have already told you what the problem is and what you need to do about it.

[Carsafety]

That is NOT a vB table, hence the error message is related to an add-on and not vB.

And besides we have already told you what the problem is and what you need to do about it.

Hi. Paul M asked for more information, so I posted it.

[WhiteOx]

The table 'scwho' is used by SigmaChat or whatever it's called now.