MyBB Community Forums

I really need it ASAP.

Somehow ... , i have forum with members of some online game , yesterday there was a problem with some main moderator and then we kick him but ... he won't do anything to us , sometime later i got 5 pm's from 5deiffrent users on my forum that tell me "i am the hacker,dont ban them on my actions".

so , i need to force change everyone password , and how the eggplant he do this? if he got our sql .. but the passwords are hard to "re hash" no?

Ok , so i need force password change for all of my users

Run this query:

UPDATE mybb_users SET loginkey='';

That will force all users to regenerate their 'loginkey' & relogin which is likely how he's getting into users accounts. The other possibility is that he is using programs to brute force passwords if he got a copy of the SQL but that's highly unlikely and would take a long time to do.

Wait , so there is security hole? =\
always need to run this thing? , how did he log just by loginkey? i want to stop that... >_<

BTW : I did run it , thanks , but why there's no fix for this thing?