MyBB Community Forums › 1.8 Support › Security Management and Support v
Accounts Hack

Threaded Mode
Accounts Hack
User 95587 Offline
Posts: 66
Threads: 20
Joined: May 2015
#1
2015-08-25, 03:06 AM (This post was last modified: 2016-02-04, 09:43 PM by User 95587.)
Now i'm not sure how this happened nor how it can be fixed. Yesterday I got on my forums with people complaining that they were hacked. I banned those accounts, and they contacted me saying that they were done messing around, although I cant have an exploit like this just possible. The hackers claimed what they did was a SQL Injection, which allowed them to get the logins for the accounts, and they also claimed that it was impossible to fix. I want to not believe that, although they could be correct. So with that said, is it possible to fix this "SQL Injection"? My friend claimed that it was something to do with vulnerable plugins, so I put together a list of plugins that I have on the mybb site. Click here to see my plugins. This might be asking a bit much, but this is really serious for the health of my community, and I feel that it should not be this easy to just get into a mybb account.

This might have been what was used to get into the site.


Regards,
Xenonzo
Find
Reply
Phantomer Offline
Posts: 59
Threads: 21
Joined: Apr 2012
Reputation: 0
#2
2015-08-25, 05:59 AM
What is your version of MyBB? According to the video, the hack was done on MyBB 1.8.1.
Website Find
Reply
User 95587 Offline
Posts: 66
Threads: 20
Joined: May 2015
#3
2015-08-25, 09:29 PM (This post was last modified: 2015-08-25, 09:31 PM by User 95587.)
(2015-08-25, 05:59 AM)Phantomer Wrote: What is your version of MyBB? According to the video, the hack was done on MyBB 1.8.1.

MyBB 1.8.5

Would you like my MySQL version as well?
Find
Reply
John J. Offline
Posts: 257
Threads: 33
Joined: Jan 2011
Reputation: 4
#4
2015-08-25, 09:41 PM (This post was last modified: 2015-08-25, 09:42 PM by John J..)
This user has been denied support. This user has been denied support.
I think this is already patched.
Find
Reply
User 95587 Offline
Posts: 66
Threads: 20
Joined: May 2015
#5
2015-08-25, 09:46 PM
(2015-08-25, 09:41 PM)John J. Wrote: I think this is already patched.

Hmm do you possibly know how some user accounts were breached? They did confirm with me that it was SQL Injections, although I'm not sure what else they did.
Find
Reply
John J. Offline
Posts: 257
Threads: 33
Joined: Jan 2011
Reputation: 4
#6
2015-08-26, 07:36 PM
This user has been denied support. This user has been denied support.
I tried it with the current version, had no success.
Find
Reply
User 95587 Offline
Posts: 66
Threads: 20
Joined: May 2015
#7
2015-08-26, 09:40 PM
(2015-08-26, 07:36 PM)John J. Wrote: I tried it with the current version, had no success.

Might not be that but I can assure you some sort of SQL injection is going on.
Three more accounts got hacked.
Find
Reply
John J. Offline
Posts: 257
Threads: 33
Joined: Jan 2011
Reputation: 4
#8
2015-08-26, 11:22 PM (This post was last modified: 2015-08-26, 11:23 PM by John J..)
This user has been denied support. This user has been denied support.
(2015-08-26, 09:40 PM)xunofar Wrote:
(2015-08-26, 07:36 PM)John J. Wrote: I tried it with the current version, had no success.

Might not be that but I can assure you some sort of SQL injection is going on.
Three more accounts got hacked.

Well then you should try removing unused plugins.
Find
Reply


Forum Jump:


Users browsing this thread: 1 Guest(s)