MyBB Community Forums

Hi all,
I have MyBB installed (about two weeks ago, replacing phpBB) onto my server.
The version is MYBB RC 4 with security patch ( http://mybboard.com/community/showthread.php?tid=692 )
Yesterday I was hacked
My site index was changed so all users were redirected to one bad page...
I have checked Apache logs and found that hackers gained control using myBB software (PHP code injection into request URI - file showthread.php).

That vulnerability allows attacker to execute any PHP and OS shell commands, write/delete files etc.. I does not want to place an exploit here before admin will fix the vulnerability (to avoid some bad people from getting idea to hack for example, forum on this site).

I would like to give an advice to all myBB software users: SWITCH YOUR FORUM INTO MAINTENANCE MODE AND RENAME/DELETE FILE showthread.php UNTIL THIS VULNERABILITY WILL BE FIXED. Your forum will be unaccessible for attackers, but also for normal visitors. Choose your poison. Anyway, if you will decide to leave your forum online, making daily backups is a good idea. Also pay some attention to your log files...

TO ADMIN: CONTACT ME AS SOON AS POSSIBLE AND I WILL SEND YOU LINES FROM APACHE LOG FILE SO YOU CAN FIX THAT SECURITY HOLE.

My email is [email protected]

gor Wrote:(PHP code injection into request URI - file viewtopic.php).

I guess you mean showthread.php, dont you? There is no file called viewtopic.php in MyBB.

Oops, sorry...
Yes I mean showthread.php file. Thanx.

Btw, I have discovered what was changed. They have changed my mySQL database My site is an open source project... I can't understand that. Real hackers never do that.

P.S. IF someone knows following morons:
http://freehost13.websamba.com/MyFilesOn...ttackByCN/
please let me know. That will help find them. Thank you.

Make sure the email is from Chris Boulton. He is the admin here. Some people might pose as him, so be careful.

http://www.mybboard.com/community/member...file&uid=1

Sure. Thanx.

As this is a serious matter i've sent you an email regarding this and am looking forward to a response.

If such an issue is found in MyBB an immediate security update will be released and all users should upgrade as soon as possible.

Man there are some sad people on the internet! What is the big the deal about hacking site! Also how the hell do they use/do this injection crap?

im not convinced that it is possible through the MyBB software.

Theres always a way AaronC
Lets hope it doesnt turn into something like phpBB did :\\

There will always be ways to hack a board, what is important is the quick response to the issue once it is found. I am confident that the staff here will have the issue resolved in no time.

A good board = great
Good support = great
A good board with good support = priceless