Piwik 1.8.3 fatal error

Support & Bugs
1

I`m unable to access my piwik installation, because of following error:


syntax error, unexpected '$' in /var/www/ad.hjk.su/web/piwik/config/global.ini.php on line 2
 
in '/var/www/ad.hjk.su/web/piwik/libs/upgradephp/upgrade.php' at the line 488

#0  Piwik_ErrorHandler(...) called at [:]
#1  parse_ini_file(...) called at [/var/www/ad.hjk.su/web/piwik/libs/upgradephp/upgrade.php:488]
#2  _parse_ini_file(...) called at [/var/www/ad.hjk.su/web/piwik/core/Config.php:205]
#3  Piwik_Config->init(...) called at [/var/www/ad.hjk.su/web/piwik/core/Piwik.php:2153]
#4  Piwik::createConfigObject(...) called at [/var/www/ad.hjk.su/web/piwik/core/FrontController.php:209]
#5  Piwik_FrontController->createConfigObject(...) called at [/var/www/ad.hjk.su/web/piwik/core/FrontController.php:260]
#6  Piwik_FrontController->init(...) called at [/var/www/ad.hjk.su/web/piwik/index.php:58]

any ideas?

2

Dear All,
I really dont understand whats happened and how can I fix it, but it`s urgent task for me. If anyone can help me or just point the way of search, It would be great!
No operations, no updates or additional plugins were installed to that system. What could it be?

3

Check your file: global.ini.php on line 2

maybe it has been edited or contians invalid character ? Maybe the server was hacked ? please check, update all your softwares on the server

4

Ive compared both files: new installation and old one - there are some encoded php script in it. Seems its some kind of shell.
Going to investigate it.

5

Hi,

I noticed quite the same error on my server. The day before yesterday it worked, and I haven’t touched it yet.


Error parsing /homepages/25/d217677376/htdocs/ducksmanager/piwik/config/global.ini.php on line 2
 
in '/homepages/25/d217677376/htdocs/ducksmanager/piwik/libs/upgradephp/upgrade.php' at the line 488

#0  Piwik_ErrorHandler(...) called at [:]
#1  parse_ini_file(...) called at [/homepages/25/d217677376/htdocs/ducksmanager/piwik/libs/upgradephp/upgrade.php:488]
#2  _parse_ini_file(...) called at [/homepages/25/d217677376/htdocs/ducksmanager/piwik/core/Config.php:205]
#3  Piwik_Config->init(...) called at [/homepages/25/d217677376/htdocs/ducksmanager/piwik/core/Piwik.php:2153]
#4  Piwik::createConfigObject(...) called at [/homepages/25/d217677376/htdocs/ducksmanager/piwik/core/FrontController.php:209]
#5  Piwik_FrontController->createConfigObject(...) called at [/homepages/25/d217677376/htdocs/ducksmanager/piwik/core/FrontController.php:260]
#6  Piwik_FrontController->init(...) called at [/homepages/25/d217677376/htdocs/ducksmanager/piwik/index.php:58]

What is strange is that in the folder named config, all the files have their last modification date at today 06:04:06.

6

Yep.
So it seems to be the Piwik security issue, because I`ve noticed several sites in google search results.
The problem can be temporary solved by replacement of all the files in directory by new ones, because you have shell script in first six strings of every php file on your server/hosting.

7

What other softwares do you use ? phpbb, phpmyadmin, wordpress ? are they affected as well as piwik ?

8

Just phpmyadmin, but there doesn’t seem to be any problem on it.

9

My wordpress, phpmyadmin scripts are not affected. DLE, zencart, openx, piwik were infected with that kind of shell.