MyBB Community Forums

omg,i got this problem 2. I think this is a big one

I discovered something :
Most of us are using WordPress,this is way we got hijack

Easy way to delete :
-reinstall mybb/wordpress
-delele the code from all index.php

(2011-10-22, 09:02 PM)Kitikru Wrote: [ -> ]omg,i got this problem 2. I think this is a big one

I discovered something :
Most of us are using WordPress,this is way we got hijack

It has nothing to do with Wordpress.

It has more to do with WordPress

Look here : %29%26%26+isset%28%24_GET[%27pass%27]%29%29{&pbx=1&oq=if+%28isset%28%24_GET[%27pingnow%27]%29%26%26+isset%28%24_GET[%27pass%27]%29%29{&aq=f&aqi=&aql=1&gs_sm=e&gs_upl=327l327l0l512l1l1l0l0l0l0l91l91l1l1l0&bav=on.2,or.r_gc.r_pw.,cf.osb&fp=eeafc1f1ce2e4153&biw=1152&bih=674]Search on google result

(2011-10-22, 09:56 PM)Kitikru Wrote: [ -> ]It has more to do with WordPress

Look here : %29%26%26+isset%28%24_GET[%27pass%27]%29%29{&pbx=1&oq=if+%28isset%28%24_GET[%27pingnow%27]%29%26%26+isset%28%24_GET[%27pass%27]%29%29{&aq=f&aqi=&aql=1&gs_sm=e&gs_upl=327l327l0l512l1l1l0l0l0l0l91l91l1l1l0&bav=on.2,or.r_gc.r_pw.,cf.osb&fp=eeafc1f1ce2e4153&biw=1152&bih=674]Search on google result

if you think its a wordpress problem, then go post on the wordpress site and not here.

(2011-10-22, 08:01 PM)pavemen Wrote: [ -> ]every file on your site can be infected by this issue, as can new files be created, database access, etc can all be compromised. its an "open" exploit that lets most any code be executed

changed my db password the other day. I think I removed all of the malicious code that was added to my files. there are a few files changed per the file verification tool, but most of it was done either by me manually or by a plugin.

although, there are two files showing changed that I'm not sure which plugin would "change" them. the two I'm not sure about are inc/functions_posting.php & inc/class_moderation.php

I do have the google seo plugin installed, so that might mess with the inc/functions_posting.php file.

nope, only functions.php is modified for SEO. you need to open those files and check the contents

(2011-10-23, 03:56 AM)pavemen Wrote: [ -> ]nope, only functions.php is modified for SEO. you need to open those files and check the contents

I just replaced both of the files I mentioned earlier with fresh copies from the mybb download package. if another plugin I was using modified those files, I'll figure it out sooner or later.