MyBB Community Forums

Full Version: possible password stolen from forum's user
You're currently viewing a stripped down version of our content. View the full version with proper formatting.
hi all, i added a custom page to mybb (1.6.12) forum.

this page call via ajax a php page passing lat e lng as parameter and returns a serach result.

$Selec is a query containg lat & lng passed from page.

into the php page this code is used to log all the calls:

$params = array(
            'Page'             =>    'search.php',
            'Params'         =>    mysql_real_escape_string($Select),
            'Time'             =>     date("Y-m-d H:i:s"),
            'uid'            =>   $mybb->user['uid']
        );
}    
    
$db->write_query("INSERT INTO Log (Page, Params, Time, uid) VALUES ('".implode("','", $params)."')");

in the log i've 2 records with the same select, exactly the same lat and lng but differents uid.
Checking the ip of the 2 users the are in two differents cities.

The only explanation one user logged in with the other credentials and made the same search.
(2016-01-14, 03:58 PM)fdb Wrote: [ -> ]The only explanation one user logged in with the other credentials and made the same search.

The first one could have used a different IP address (proxy, VPN) or your IP geolocation service might have obsolete data. I would recommend contacting them.

You should consider upgrading MyBB to 1.8 since updates for 1.6.x are no longer provided.
Hi,

Sorry, we no longer provide support for 1.6. Please see this announcement: http://blog.mybb.com/2015/10/01/support-...has-ended/