Confirm the bugs, Hope Cybernetec fix that soon :-)))))

I mention and said the warning on : https://vborg.vbsupport.ru/external/2009/04/27.gif 14 Jan 2009, 00:48

https://vborg.vbsupport.ru/showpost....7&postcount=12

This plugin has many bugs ! Specially when you use vbseo or some kind of rewrite_mods !!

It seems some how funny ! because an Administrator use this plugin to log in to user account and read private messages and so on .. BUT the Administrator causes to "hijack" his/her own account first ! and make an unwanted dangerous bug in his/her own forums!!

I am still wondering why this 3.7 version is not already in the graveyard like the 3.8 version. :mad:

This version has the same severe security bug!!! :(

Send it to the graveyard at once and inform every user of this addon by email to deactivate it like you did this morning with the 3.8 version!

How long are you going to wait? Until many users complain, that their forums have been nuked?! :confused:

Come on! It's never been easier than today to get full control over a foreign vB by just modifing your browsers URL! :mad:

Is this safe without an SEO?

NO! It does not matter if you have SEO installed or not. In both cases any account in your forum can be hijacked as long as you don't disable this AddOn.

Okay, I think this should fix it.

Try it out and see if you can still exploit it.

note: the attached plugin originates from the 3.8 version which is now in the graveyard, but it should probably work for 3.7 as well :)

edit: er, apparently vBulletin doesn't prompt you to overwrite plugins which is kinda lame (heh, been a while since I've uploaded plugins rather than products).

You should delete "Cyb - Login To User Account - MI" and then upload my attachment.

Thx for Version 2.3 (re-installed) :-)

Awesome, thanks for the update :D

many thanks
Installed and working well with 3.8.2

Thanks again! Re-installed