Database tables wiped out suddenly

[almustone]

Hi!

I had installed cmsms 2.1.3 on my website. It runned smoothly about 5 months, but a couple of days ago suddenly my page contents dissappeared. I recovered website live with a week old backup and updated my cmsms to 2.1.5.

Today I was updating content but then my user accounts table cleared and I was unable to log in. I recovered website live back with database backup taked earlier today.

Before todays crash I updated Slideshows, content and news. I upload files via TinyMCE Responsive File Manager. There have been error message with that plugin language file. I'm from Finland, but there is no language support with Finland, so I have made new language file named "fi_FI.php" which is copy of english language.

Now I have made these updates again to try to find which trigger this crash, with no luck.

I just tought that might there been any problems with database? It seems that everything with settings are right. I found out that all my database tables are MyISAM but my database default setting is INNODB. May that cause something problems? Database encoding is utf8_8general_ci like all my tables.

I know that some files are uploaded with special characters like ä and ö and white space. Can these cause problems?

I don't see any proof of hacking eather. All files looks normal and website content too.

Only some db tables are cleared out.

If you guys have any suggestions what to do I will be very grateful. If you need more info please ask me. I update also new errors.

My file checksum looks clear. Only problems with some language files:

9 Files Not found
Files Not found:
/admin/lang/ext/uk_UA.php
/admin/lang/ext/so_SO.php
/admin/lang/ext/rm_CH.php
/admin/lang/ext/fa_FA.php
/admin/lang/ext/eo_UY.php
/admin/lang/ext/mn_MN.php
/admin/lang/ext/vi_VN.php
/admin/lang/ext/gl_GL.php
/admin/lang/ext/iw_IL.php

20 Files failed md5sum check:
/modules/CMSMailer/lang/ext/fa_FA.php
/modules/CMSMailer/lang/ext/iw_IL.php
/modules/MenuManager/lang/ext/rm_CH.php
/modules/MenuManager/lang/ext/fa_FA.php
/modules/MenuManager/lang/ext/iw_IL.php
/modules/News/lang/ext/fa_FA.php
/modules/News/lang/ext/mn_MN.php
/modules/News/lang/ext/vi_VN.php
/modules/News/lang/ext/iw_IL.php
/modules/MicroTiny/lang/ext/fa_FA.php
/modules/MicroTiny/lang/ext/vi_VN.php
/modules/MicroTiny/lang/ext/iw_IL.php
/modules/FileManager/lang/ext/fa_FA.php
/modules/FileManager/lang/ext/iw_IL.php
/modules/Search/lang/ext/rm_CH.php
/modules/Search/lang/ext/fa_FA.php
/modules/Search/lang/ext/iw_IL.php
/modules/ModuleManager/lang/ext/rm_CH.php
/modules/ModuleManager/lang/ext/fa_FA.php
/modules/ModuleManager/lang/ext/iw_IL.php

----------------------------------------------

Cms Version: 2.1.5

Installed Modules:

AdminSearch: 1.0.2
CMSContentManager: 1.1.1
CMSMailer: 6.2.14
DesignManager: 1.1.1
FileManager: 1.5.2
FormBuilder: 0.8.1.4
Gallery: 2.1.6
MenuManager: 1.50.2
MicroTiny: 2.0.3
ModuleManager: 2.0.4
Navigator: 1.0.3
News: 2.50.5
Search: 1.50.2
Showtime2: 3.4.5
ThemeManager: 1.1.8
TinyMCE: 3.1.3


Config Information:

php_memory_limit:
max_upload_size: 20000000
url_rewriting: mod_rewrite
page_extension:
query_var: page
auto_alias_content: true
locale:
set_names: true
timezone: Europe/Helsinki
permissive_smarty: false


Php Information:

phpversion: 5.6.24
md5_function: On (True)
json_function: On (True)
gd_version: 2
tempnam_function: On (True)
magic_quotes_runtime: Off (False)
E_ALL: 22519
E_STRICT: 0
E_DEPRECATED: 0
test_file_timedifference: No time difference found
test_db_timedifference: No time difference found
create_dir_and_file: 1
memory_limit: 128M
max_execution_time: 60
register_globals: Off (False)
output_buffering: 4096
disable_functions:
open_basedir:
test_remote_url: Success
file_uploads: On (True)
post_max_size: 20M
upload_max_filesize: 20M
session_save_path: /tmp (0777)
session_use_cookies: On (True)
xml_function: On (True)
xmlreader_class: On (True)
check_ini_set: On (True)
curl: On


Performance Information:

allow_browser_cache: Off (False)
browser_cache_expiry: 60
php_opcache: On (True)
smarty_cache: Off (False)
smarty_compilecheck: Off (False)
smarty_cache_udt: Off (False)
auto_clear_cache_age: On (True)

Server Information:

Server Software: Apache
Server Api: cgi-fcgi
Server Os: Linux 2.6.18-410.el5 On x86_64
Server Db Type: MySQL (mysqli)
Server Db Version: 5.5.45
Server Db Grants: Could not find a suitable "GRANT ALL" permission, this does not necessarily lead to problems... But if you have problems installing/removing modules or adding and deleting items/pages this could be the cause!

Permission Information:

tmp: mywebsite/public_html/tmp (0775)
tmp_cache: mywebsite/public_html/tmp/cache (0775)
templates_c: mywebsite/public_html/tmp/templates_c (0775)
modules: mywebsite/public_html/modules (0775)
uploads: mywebsite/public_html/uploads (0775)
Tiedostojen luontimaski (umask): mywebsite/public_html/tmp/cache (0775)
config_file: 0444

----------------------------------------------

[Rolf]

You have contacted your web host already?
Are there other websites at the same account at that server?
Changed db password?

Grtz rolf

[almustone]

Hi!

Today it happened again and some of my content disappeared suddenly. There was no activity at admin log, but I found out that there was modified file at plugins folder.

I'm using Facebook Like Buttons plugin: http://dev.cmsmadesimple.org/projects/likebutton

And that function file was modified right before content disappearing, but file content looks pretty normal and plugin is still working after database backup. I now removed file and all the tags.

I think it is better ask for new db and ftp passwords and check website files with virus scanner.

Anyone else have had similar problems with that plugin or am I just paranoid?

- Aleksi

[calguy1000]

I am watching this tread with interest... Two or three others have reported similar issues, but have been unable to narrow down the problem to a single action or piece of code. I have never been able to reproduce the issue, even on one of the 'test accounts' where it reportedly occurred.

So, If this is a CMSMS issue, we need a defined and predictable way to reproduce the issue so that we can investigate it. Otherwise, we don't know what we're looking for.

[almustone]

That Facebook plugin was my mistake and it is not the cause. I only watched clock editing time, not date which is a couple of months ago. But anyway, I removed that plugin.

Mystery is still there, but I try to find it tonight.

- Aleksi

[almustone]

Hi!

I downloaded all my website files and checked them with Avast antivirus. All files were clean.

I also checked those database backups more closely before and after first crash this week monday and I noticed that the whole tables were removed, not only data inside them.

On monday when the first crash happened my "adminlog", "content_props", "layout_designs" and "modules" tables were deleted.

I couldnt see what there was happened right before crash, because adminlog was cleared but there was another backup taken 5 days before and from there I noticed some error messages:

'An error has occurred', 'Unable to load template cms_template ''Summary_Simplex
'An error has occurred', 'Unable to load template cms_template 'Summary_Simplex AND 1=1'' in ''tpl_body:37'
'Missing Template: Summary_Simplex AND 1=1'
'An error has occurred', 'Unable to load template cms_template ''Summary_Simplex2121121121212.1'' in ''tpl_body:37'
'FormBuilder', '-- Missing Languagestring: log_suspected_spam --' <-- repeated multiple times in one time
'Core', 'Missing Template: Summary_Simplex''
'An error has occurred', 'Unable to load template cms_template ''Summary_Simplex" and "x"="x'' in ''tpl_body:37'
'Core', 'Missing Template: Summary_Simplex" and "x"="x'

And there were same kind of error messages with my own news summary template. These error messages were during month period of time, but website has been running well and new news have been created with no problems and what so ever. These error messages was with CMSMS 2.1.3 version and now I have updates my CMS to 2.1.5 version after this week monday crash and there have no been error messages at admin log after it, but content is still dissapearing.

I hope this will help you guys to find out whats wrong.

- Aleksi

[Rolf]

But did you change database and ftp/ssh passwords?

[almustone]

Not yet. My web host has been very busy and didn't answer my questions fast. I also have asked for more specific log files from webhost to see what kind of traffic there have been and what have been done. It's weekend now and I think I can't get new passwords during weekend.