MyBB Community Forums

Hello,

About a week ago our forum at www.TeamBrotato.com was hacked. We are still attempting to clean up and fix everything, but I can't figure out how they got in.

They made two accounts on the site. They were somehow able to make themselves admin and then proceeded to delete all the theme templates, delete just 1 of our users (still no clue why), download a backup of the database and edit the header (You can see the result of all this at the site.

Here are the plugins I have installed:
-SignHeightLimit (1.0)
-Ajax PM Notification (1.8.1)
-Anti Proxy. (1.1)
-Bad Words - Quick access (0.9.7 beta)
-Donation Page (2.1)
-Fit on Page (2.3)
-Force Postbit Layout (1.0)
-Gaming ID`s (1.1)
-MyBB GoMobile (1.1)
-Header Announcements (1.0)
-Hellban (1.0)
-HTML in Posts (1.5) (Limited to admins)
-IP Manager (0.1)
-ircBB Chat (1.0)
-Mods Cant Edit Admins Posts (1.1)
-My Advertisements (2.0.3)
-MyCode Installer (1.0)
-MyShoutbox (1.7)
-Page Manager (1.5.2)
-Private Messages Admin (2.4.3)
-PM On Registration (1.2.0)
-Profile Skype ID (1.0)
-Sidebox (1.2.0)
-Spell Check (1.4.1)
-Ultimate Backup Utility (1.0)
-User Rank Image (1.0)

Looking at it now we have a lot more plugins then I thought

If anybody has any idea of how this may have happened, please let me know.

Profile Skype ID - it's vulnerable. That's how they managed to get in.

(2013-01-16, 04:25 AM)Nathan Malcolm Wrote: [ -> ]Profile Skype ID - it's vulnerable. That's how they managed to get in.

Thank you very much!

For Skype stuff, add a custom profile field.

(2013-01-16, 04:25 AM)Nathan Malcolm Wrote: [ -> ]Profile Skype ID - it's vulnerable. That's how they managed to get in.

Glad to see this forum is becoming really helpful to the MyBB community.

Apparently http://mods.mybb.com/view/donation-page

this is SQL injectable.

(2013-01-20, 12:41 AM)therussiangamer Wrote: [ -> ]Apparently http://mods.mybb.com/view/donation-page

this is SQL injectable.

It's not. It doesn't query the database.

Your question has been answered so I won't repeat the same thing but as for the hellban plugin, please check the following thread.

http://community.mybb.com/thread-132282.html

P.S: It's not vulnerable, just a discussion you might be interested in.

(2013-01-16, 06:49 AM)Josh H. Wrote: [ -> ]For Skype stuff, add a custom profile field.

Actually, you might as well rename MSN to Skype, since MSN/WLM is being eliminated by March. And all MSN users can sign into Skype with their same account anyway.

To do this, locate the file: "member.lang.php" in inc\languages\english.

Edit the file and find the line:

$l['msn'] = "MSN ID:";

Replace with:

$l['msn'] = "Skype ID:";

"It's SQL injectable
Written By: AnonMagic528, 31st December 2011"

This was posted on that Donation Page thing

but if you say so, that's good.!