Support Forum
We've been getting hammered over the past few days by bots with banks of IP addresses scanning our WordPress db for vulnerability. We're getting things under control, but in troubleshooting this, the following error has been popping up numerous times in the logs:
[Mon Jun 17 10:01:43 2013] [error] [client 111.223.131.87] WordPress database error Unknown column 'usergroup_badge' in 'field list' for query SELECT wp_1_sfmemberships.usergroup_id, usergroup_name, usergroup_desc, usergroup_badge, usergroup_join\n\t\t\tFROM wp_1_sfmemberships\n\t\t\tJOIN wp_1_sfusergroups ON wp_1_sfusergroups.usergroup_id = wp_1_sfmemberships.usergroup_id\n\t\t\tWHERE user_id=182 made by require('wp-blog-header.php'), require_once('wp-includes/template-loader.php'), include('/themes/wpmu-nelo-child/page-full-width-forums.php'), the_content, apply_filters('the_content'), call_user_func_array, sp_render_forum, sp_process_template, sp_load_template, include('/sp-resources/forum-themes/default-custom3b/templates/spTopicView.php'), sp_this_topic, spTopicView->__construct, spTopicView->sp_topicview_query, sp_get_user, spUser->__construct, sp_get_user_memberships, spdb_select
The ip address and user_id=x entry is bold because those seem to be the only two variables changing in all occurrences of the error. The requests are coming from numerous IP addresses.
Any help in deciphering and eliminating this error is greatly appreciated. Not sure if it's even related to our recent rogue activity, but could use some help regardless trying to nail it.
Andy & Steve: You may recall I recently deleted a bunch of users, and some of heir metadata from sf tables using the queries we discussed a couple weeks ago. Could this error be caused in any way by the work I did to remove users from sf_members while keeping them in wp_users. For the record, in the case of the error above, user_id 182 is still an active sf_member and wp_user, and that is clearly not her ip address.
As usual, thanks in advance for any help!
Simple:Press powers the Tripawds Discussion Forums.
It's better to hop on three legs than to limp on four.
The Tripawds Blogs Community is made possible by The Tripawds Foundation.
well lets start with the obvious... in your sfusergroups table, do you have a column called usergroup_badge? you should as it was an upgrade many versions ago...
if you do not, just add it... create the column with a varchar(50)...
Visit Cruise Talk Central and Mr Papa's World
Mr Papa said
in your sfusergroups table, do you have a column called usergroup_badge?
Yes, the column is there. Entry for two of the rows, however, is NULL. Two rows have the correct badge indicated, and two more are empty, presumably since those groups have no badge assigned.
Anything look fishy here? Recommended next steps? We're continuing to see the error, alot.
Simple:Press powers the Tripawds Discussion Forums.
It's better to hop on three legs than to limp on four.
The Tripawds Blogs Community is made possible by The Tripawds Foundation.
odd. the error is pretty clear it cannot access that column... the null wont matter...
at this point, I would try doing a db repair - at least on the sfusergroups table...
Visit Cruise Talk Central and Mr Papa's World
Mr Papa said
odd...
Well, I guess it helps to be looking at the correct database!
Yes, the column was indeed in the correct table of the db for our live site. Upon further investigation, I noticed it missing from the db for our dev install. As in the error above, most of them have no referrer so it didn't even dawn on me to look there.
After adding the column, the error changed indicating an unknown "usergroup_join" column. After adding that, the errors appear to have stopped, so far.
Thanks once again for pointing me in the right direction. I just had to take the right path! Not so "odd" after all...
Back to the task at hand of wrangling these rogue db scans that are throwing our Apache and MySQL processes into a tailspin. We've blocked suspect countries and are now passing traffic through CloudFlare, but it appears the script may be targeting the box by IP address which will bypass any CloudFlare filtering.
{end rant}
Simple:Press powers the Tripawds Discussion Forums.
It's better to hop on three legs than to limp on four.
The Tripawds Blogs Community is made possible by The Tripawds Foundation.
good to hear - glad its resolved... good luck with the other part!
Visit Cruise Talk Central and Mr Papa's World