MyBB Community Forums

Thank you to everyone that has posted and the wonderful assistance that I have found on these forums, I have never needed to ask a question, and simply came right by searching for what i needed.

In return I would like to offer this fix, from what I did yesterday on both my forums after I was hacked.

--------------------------------------------------------------------
THE FIX.....
--------------------------------------------------------------------

There was an exploit on MYBB ver 1.4.6 that allowed hackers to insert a piece of code into your themes directory.
This is used to change the landing page of your default theme. The quickest way to get rid of this problem is firstly to ftp to your server and delete the file /cache/themes/themes.php, it is not a valid mybb file and is the code used for the exploit.

Then go to MYBB admin console--> Themes and templates--> Templates--> expand default template--> click on options for index and select revert to defaults.

Forum will now return to normal operation. It is very important though, that 1.4.6 be upgraded to 1.4.8.

We already know this, but useful information all the same

I just wanted to make it easy to find.

I went searching through threads to find the fix, and just condensed it here as a quick and easy reference.

Thanks for all the great info on the forums though.

Can someone point me at the specific patch to deal with this specific issue? Upgrading to the new version on a flash basis just isn't possible, but I would like to lock this particular exploit out. Thanks!

(2009-07-03, 09:08 AM)freerider Wrote: [ -> ]Thank you to everyone that has posted and the wonderful assistance that I have found on these forums, I have never needed to ask a question, and simply came right by searching for what i needed.

In return I would like to offer this fix, from what I did yesterday on both my forums after I was hacked.

--------------------------------------------------------------------
THE FIX.....
--------------------------------------------------------------------

There was an exploit on MYBB ver 1.4.6 that allowed hackers to insert a piece of code into your themes directory.
This is used to change the landing page of your default theme. The quickest way to get rid of this problem is firstly to ftp to your server and delete the file /cache/themes/themes.php, it is not a valid mybb file and is the code used for the exploit.

Then go to MYBB admin console--> Themes and templates--> Templates--> expand default template--> click on options for index and select revert to defaults.

Forum will now return to normal operation. It is very important though, that 1.4.6 be upgraded to 1.4.8.

Look on the blog for the 1.4.7 release patch file.

Got it. Thanks much.

(2009-07-08, 03:23 AM)Dennis Tsang Wrote: [ -> ]Look on the blog for the 1.4.7 release patch file.