Major issue - database records rewritten !

Permalink
Our main domain ishttp://www.helena-biosciences.com

We also have various parked domains that point into the main domain at the host level.

I set the site up using version 5.6.0.2, which is the version is was locally developed on.

The site was updated over the weekend to 5.6.1.2 which helped in page load speed and general performance terms

No content has been manually edited - everything was contained in the MySQL dump that was used to set the site up with on its live server.

Several of our main navigation links have been rewritten and the database records amended !

Basically, some top-level links in the database records now point to:

http://helena.co.uk (one of our parked domains)

or

http://kotoko.helena.co.uk (a non-existent sub-web within the above domain)

If you visit the contact us pagehttp://www.helena-biosciences.com/en/contact/... and check the Home page link at the top left of the page where the main navigation link live you will see that “home” now points tohttp://helena.co.uk which illustrates the problem perfectly.

Three different page headers contained the below code:

<meta name="generator" content="concrete5 - 5.6.1.2" />
<script type="text/javascript">
var CCM_DISPATCHER_FILENAME = '/index.php';
var CCM_CID = 1;
var CCM_EDIT_MODE = false;
var CCM_ARRANGE_MODE = false;
var CCM_IMAGE_PATH = "/concrete/images";
var CCM_TOOLS_PATH = "/index.php/tools/required";
var CCM_BASE_URL = "http://www.helena-biosciences.com";
var CCM_REL = "";
</script>
<meta name="generator" content="concrete5 - 5.6.1.2" />
<script type="text/javascript">
var CCM_DISPATCHER_FILENAME = '/index.php';
var CCM_CID = 1;


So three different pages displayed the same page ID number, but with a different corresponding base URL.

This information has been written back to the database and is stored in one form or another in 19 different page caches.

In my world a CMS can be used to back-end edit page content or a database import/edit can do the same. There is no third option under normal circumstances.

I have never seen anything like this and it obviously raises some pretty fundamental questions.

To recap, the information currently being serve from cache was never in the imported database to begin with but the CMS has somehow got hold of it and compiled it into cashed content, effectively rewriting top level navigation in 19 separate instances.

I have to assume that page content and not just navigation links may also have been changed.


My questions are many but can be summed up as follows:

How can this happen ?

Why would this happen ?

How can I prevent it from happening going forward ?

I don’t want to hear that the Concrete version update may be responsible because it doesn’t address how on earth a parked domain (or a subweb within it) could end up being referenced in content that has somehow changed since the database was originally imported.

I am putting this in the installation help forum since I don't where where else it could go...

 
JohntheFish replied on at Permalink Reply
JohntheFish
If you never entered 'kotoko' at any point in developing the site, that is information that never existed in the database before this issue.

Whatever else below makes sense, in my reply or others, you need to consider the possibility that your hosting account or site has been (partly) hacked as it represents a big threat.

Throwing out wild ideas, maybe your web server (perhaps via .htaccess or host settings) is set up to forward unknown sub-domains to the actual domain. Once forwarded, maybe a cached page could becomes set on the incorrect sub-domain and then served on the primary domain. Clearing the cache may remove such incorrect header information. Stopping it recurring would be something in your server settings.