New Security Issue in VB?

Discussion in 'vBulletin Discussions' started by Autopilot, Aug 24, 2013.

  1. Autopilot

    Autopilot Regular Member

    514
    334
    462
    This was just posted on the VB board (yesterday?) and I guess the obvious question is can someone actually sign themselves up as admin?

    What would cause a hole like this if it's possible?

     
  2. thebrad

    thebrad Regular Member

    172
    18
    349
    There must be some hack he is using to make himself admin you can't just do that... seriously some pro hacker must of done this or its possible this guy could be lying i don't know though.
     
  3. Dan Hutter

    Dan Hutter aka Big Dan

    1,412
    515
    818
    I'd look at sever security problems too. They could have changed their usergroup via mySQL.
     
  4. djbaxter

    djbaxter Regular Member

    261
    162
    418
    What's the link to the vB.com thread?
     
  5. Autopilot

    Autopilot Regular Member

    514
    334
    462
  6. Paul M

    Paul M Dr Pepper Addict

    449
    136
    418
    Sounds like they managed to run an SQL query.
    While I havent looked at the code recently, I dont think you could run the normal registration code without it storing the IP address.
     
    Brandon likes this.
  7. dandanch

    dandanch Regular Member

    38
    18
    44
    That same thing happen to my friends site on friday, not once but twice, so yes
    there is some kind of exploit..
     
  8. Paul M

    Paul M Dr Pepper Addict

    449
    136
    418
    An exploit has been confirmed today, via the upgrader code. It affects 4.1, 4.2 & 5.0.

    The easy prevention is to delete the "install" folder once you have installed, its not needed for day to day running.
     
    dandanch and djbaxter like this.
  9. BamaStangGuy

    BamaStangGuy Administrator

    769
    549
    518
    The hash for the customer id was in the HTML source and they have no idea why because no one knows what the [****][****][****][****] they are doing at that company anymore. I don't know how many more fails some of you need to get your hard work off of vBulletin and on to a software that actually gives a shit about working for you.
     
    Mike Edge likes this.
  10. KW802

    KW802 Regular Member

    163
    102
    418
    For the curious, here's the vB announcement thread...

    http://www.vbulletin.com/forum/foru...l-vbulletin-exploit-vbulletin-4-1-vbulletin-5

     
  11. dandanch

    dandanch Regular Member

    38
    18
    44
    @BamaStangGuy please my friend don't think because your on some other forum software your shit can't be hacked. It's just a matter of time before those [****][****][****][****][****][****][****] find some kind of exploit on the software your running.
     
    Superboy and djbaxter like this.
  12. Paul M

    Paul M Dr Pepper Addict

    449
    136
    418
    Oh look, what a surprise, the same old moronic record played again, by the same old muppet. No surprise I guess since all you can do on a day to day basis is slag off IB and and its staff. Why dont you go and post in Freddies farewell post about how he no no clue what the [****][****][****][****] he was doing. Im sure he'll be pleased to hear from you, or better still just shut the [****][****][****][****] up.
     
    Superboy, djbaxter and GTB like this.
  13. BamaStangGuy

    BamaStangGuy Administrator

    769
    549
    518
    Thanks for the reply. Until your company acknowledges the complete and utter incompetence that you and the rest of the staff there have shown I'll continue to point it out where I see fit. It's good to know you are finally getting frustrated though. I don't blame you. It must be tough as [****][****][****][****] to work for vBulletin these days.

    Try not to take it out on the license holders that pay your salary though. I still have my fair share of vBulletin licenses and still have to deal with your company in the process of moving on to better software.

    P.S. Adding me to your ignore list will help the "shut the [****][****][****][****] up" part of your statement. You might be impressed by how well it works compared to vBulletin. :)
     
    Last edited: Aug 27, 2013
    Code Monkey, Big al and Autopilot like this.
  14. BamaStangGuy

    BamaStangGuy Administrator

    769
    549
    518
    I am under no delusions. It is a different story, however, when the security exploits are found in software where the company has shown complete disregard for customer satisfaction in every aspect of their business.
     
  15. Alfa1

    Alfa1 Regular Member

    303
    196
    418
    Are you the new Xtreme marketing guy at vbulletin now?
     
  16. CM30

    CM30 Regular Member

    901
    500
    462
    Just... wow. That's an extremely unprofessional way to be talking to customers on another website, and it's something that makes me real glad I switched from vBulletin when I did.
     
    Code Monkey and Big al like this.
  17. GTB

    GTB Regular Member

    1,791
    270
    762
    Well said. There's another MUPPET above this post as well, that Super Mario clown..
     
  18. Paul M

    Paul M Dr Pepper Addict

    449
    136
    418
    I'm a member of this forum as a Forum Administrator, my forum has no customers.
    If you switched away from vbulletin then why are you even in a vBulletin discussion forum.
     
    djbaxter likes this.
  19. BamaStangGuy

    BamaStangGuy Administrator

    769
    549
    518
    You represent vBulletin especially when you come in vBulletin threads about vBulletin exploits and provide insight into vBulletin issues from a vBulletin employees view point.

    When you want to lose your shit and tell me to [****][****][****][****] off, shut the [****][****][****][****] up or whatever your heart desires, your vBulletin staff title just doesn't disappear.

    I actually like you. That might shock you but I admire what you have done for vBulletin.org and have used many of your plugins. However, you are the worst when it comes to interacting with people and so many people have pointed it out. You might not give a [****][****][****][****] but don't be surprised when you get push back over and over again over it.

    If you don't like what I say about your company then ignore me. If you don't like me pointing out how god [****][****][****][****]ing awful your company is then ignore me.

    Please, ignore me and ignore the growing number of people that despise how your company has ruined a great thing and shit on their customers.

    Ignore it. Take Bob Brisco's lead and just never try to interact with customers. Enjoy getting the paycheck and stop being a douche to customers because you are tired of reading how much they hate the company you work for. Ignore me. Please.
     
    Last edited: Aug 27, 2013
    Big al and Autopilot like this.
  20. djbaxter

    djbaxter Regular Member

    261
    162
    418
    Let's try to get this thread back on topic...

     
    Brandon and Eric Lyon like this.

Share This Page