how to find out username and password

[Overlander]

I did a site for a friend, probably two years ago now. He now wants to make changes to his site. He couldnt find the details I sent him about logging in, I can't find them either at my end.

Is there any file in cmsmadesimple that will allow me to see what his username and password is, so he can access his admin?

regards

Mark

[calguy1000]

The username(s) and passwords are stored in the database, and the passwords are encrypted with a 1 way password scheme.  If you search through the cms_users_table you'll see the usernames:

Code: Select all

mysql> select user_id,username,password from cms_users;
+---------+----------+----------------------------------+
| user_id | username | password                         |
+---------+----------+----------------------------------+
|       1 | admin    | 9dfb6c17c8992e3a821c47b68fe8e76a |
|       2 | editor   | 5aee9dbd2a188839105073571bee1b1f |

This will tell you the username of the 'master' account (user_id == 1)

then you just need to reset the password.  This mysql command (thanks mark) will reset the password to 'admin'

Code: Select all

UPDATE cms_users SET password = '21232f297a57a5a743894a0e4a801fc3' WHERE user_id = 1;

DOCUMENTATION TEAM: please add this to a faq,

[calguy1000]

Your looking at the structure of the table, not the content of the table.  The query above will show you the contents of the user table.

[alby]

Hate to sound utterly dumb but I've no idea where to look for the database structure as you provide it here?  I'm a total novice on PHP in any form which is why I chose CMS, but now am somewhat stumped.  Anyone willing to help out a dumbo on this and point me in the right direction??  I've also no idea how you go about putting in the query mentioned    Appreciate any help you can add to this.  TIA

Have you phpMyAdmin (or other SQL editor program with your host panel) on your server?
It's simple with this program look into table and update row

Alby

[Matthias CMS]

Dear all,

thank you for that discussion. It helped me a lot when I had the following problem.

The login data for the admin account were still "admin" (both user name and password) because I had just installed the site. Suddenly a script appeared on the homepage, a simple alert with some Harry Potter magic formula. This was the first time I got in touch with Harry Potter...

The next thing I found out was that the admin password had been changed! I could reset it easily, thanks to your earlier SQL counter-charm discussion.

I am not familiar with this kind of forums, but I would just like to recommend you to warn users about this kind of security issues. I read and observed many recommendations concerning the CHMODs and the deletion of certain files when I installed CMSMS. Couldn't you add a hint there, telling users to change their admin password immediately? I know, I should have known... But I wasn't aware.

Looking forward to further releases!

Regards,
Matthias

[calguy1000]

The installer lets you choose your own admin password,  setting it to 'admin' on a live webserver was a bad choice.

[mogal]

I'm having the same problem... I put the query string in under the cms_users  table in the box where it stated: Run SQL query/queries on database db21xxxxx1 (was that the right place?) but I still can't get logged into the admin panel with admin/admin

I have no clue on the phpmyadmin thing so probably really screwed up the whole thing....any help??

pam

[rtkd]

if u don't want to reset ur password and have a reasonably fast box around,
u could also just use oxid's cain&able to reconstruct it from the md5 hash.

rtkd

[PNS]

So... our staff person lost the password, she worked with developers who were graduating college seniors, now she left the company and I need to figure out how to access our website.  I really, really need some guidance.  We are using version 0.12.1.  I read that I should be able to find the password in the data base but I'm not sure where to find the database.  Wouldn't this be at the web hosting site??  If so, is there a way to find out who that is?     

[cyberman]

@PNS:

It's done

http://wiki.cmsmadesimple.org/index.php/FAQ/Login

Does the link help?

It's not possible to find out the password - the tipp set only a new password for admin user.

Do you know how to access to your database?

[PNS]

Thanks for the FAQ link.  But I need to know how to access the database.  Any suggestions.  Thanks

[cyberman]

Do you know what a type of database you are using? MySQL? PostgreSQL? SQLite?

There are some options to get access to database. It's depending from your servers / host account defaults.

If you are use for instance mysql there exists an admin named phpmyadmin. So it could be possible to get access via your-domain.com/phpmyadmin. Other providers give only access via his own admin console. There are too lot options for a quick help ...

[JayDee]

then you just need to reset the password.  This mysql command (thanks mark) will reset the password to 'admin'

Code: Select all

UPDATE cms_users SET password = '21232f297a57a5a743894a0e4a801fc3' WHERE user_id = 1;

With this line you will first need to hash your password before you can change it.
An unnecessary in-between-step I believe. The following code should do it all at once and prevents users from setting the admin pass back to 'admin' which is, as you said, not the brightest option. This works with mysql and postgresql. Unfortunately not with mssql, but users of mssql usually have a bit more knowledge.

Code: Select all

UPDATE cms_users SET password = md5('type_new_pass_here') WHERE user_id = 1;

A summary:

How to access your database
Very hosting dependant. A usual database management program is phpmyadmin which can often be found at http://phpmyadmin.yoursite.com or www.yoursite.com/phpmyadmin or via the backend of your hosting provider. If you can't find it check the site of your hosting or ask them for support. This is basic website administration and has nothing to do with CMSMS.


How to change my password
Find the users table (and open it if on phpmyadmin). The default prefix is cms_ so it will be called cms_users. Perform the query mentioned by me or calguy (in phpmyadmin: click on the tab "SQL"). You may need to change the table prefix in those queries (the cms_). If, after submit, you see something like "Updated rows: 1 (Query took 0.0009 sec)" you should be able to login with your new password.

[RonnyK]

then you just need to reset the password.  This mysql command (thanks mark) will reset the password to 'admin'

Code: Select all

UPDATE cms_users SET password = '21232f297a57a5a743894a0e4a801fc3' WHERE user_id = 1;

With this line you will first need to hash your password before you can change it.
An unnecessary in-between-step I believe.

Not really, as it resets your pw to 'admin' and with that it makes the backend accessible to you again.... So no need to hash, but when you hash you can set the correct one at once, that is right....

Ronny

[thecrush]

I tried this and saw that the password field for user_id 1 now says 21232f297a57a5a743894a0e4a801fc3 yet I still can't login using the password 'admin'. I even tried to insert a new user but that won't let me log in as well.

May I ask what the value of the admin_access should be? Right now, it's set to 1.