MyBB Community Forums

I'm running on the latest MyBB 1.4.4 security and maintenance patch.
However somehow I keep getting hacked into. They seem to be able to access my config.php and get my database details, change my password to my forum account and change my index to redirect to there website.

Therefore I think they can access phpmyadmin with my database user and its really annoying me.

Anyone know what this is and if you already know about this is there a patch to prevent this happening or anyway I can secure my config.php file.

Thanks.

---

I think its a MySQL injection, a way to prevent these?

The configs aren't in the database at all.
If they did inject your database it would really help with an server log to check it out, also time when it happend.
You can get these logs via cpanel or anything like that if you have it on your host, or you can contact your host and they'll provide it.

What plugins are you running?

Change your MySQL user password, FTP password, SSH password, cPanel Password, etc.

And make very regular backups (i.e. one a day) in case they do any damage.

If it were me, I'd look for other admins that have been added, then backup everything, and upload all new html files.

What would uploading new files do?? And they're PHP, not HTML If you do indeed mean the MyBB files...

Are there any other people with database access, Combo??

CHMOD ./inc/config.php to 444 just 'in case' they're managing to write different details to it (not that writing new stuff to config.php would change the actual database details but still...).

(2008-12-16, 03:19 PM)MattR Wrote: [ -> ]What would uploading new files do?? And they're PHP, not HTML If you do indeed mean the MyBB files...

if you wipe the existing files, then upload new html / php / jpg / cgi files, then any backdoors / file uploaders / viruses that the hacker has left will be deleted.

I've been exploited before (I'm talking online here ) and had undeletable files uploaded, normally in the cgi-bin.

My point is that you have no idea what files have been changed - better to start fresh.

You Might Wanna Take A Look At This
CHMOD_Files

Ah of course... if you do delete files though, don't delete ./inc/config.php or ./inc.settings.php, and maybe save plugin files etc...