vb.org Archive - Bogus subscriptionss.php inserted into /forums directory

vb.org Archive (https://vborg.vbsupport.ru/index.php)

- vB4 General Discussions (https://vborg.vbsupport.ru/forumdisplay.php?f=251)

- - Bogus subscriptionss.php inserted into /forums directory (https://vborg.vbsupport.ru/showthread.php?t=313437)

loua_oz

08-04-2014 03:01 AM

Bogus subscriptionss.php inserted into /forums directory

1 Attachment(s)

VB Maintenance detected that there is a file that is not part of VBulletin

/forums/subscriptionss.php

I don't know what it does (now I can not have a look into it) but when I redirected to it, the screen I got is attached.

How did they insert it? Anything I can do to prevent it?

VB 4.2.2 Patch 1
Vanilla, not a single plugin
No install directory

Turned my site off until I get on the machine where I can remove the file.

AusPhotography

08-04-2014 07:51 AM

There are other attack vectors such as via insecure hosting

Change all of your passwords ASAP (root, hosting account etc.)

ozzy47

08-04-2014 08:14 AM

Please read the following two blog posts:
http://www.vbulletin.com/forum/blogs...ve-been-hacked
http://www.vbulletin.com/forum/blogs...vbulletin-site
Also please see these recent security announcements:
vBulletin 4.1.x-4.2.x & All versions of vBulletin 5: http://www.vbulletin.com/forum/forum...-1-vbulletin-5
vBulletin 5.0.x patch released, for a different security issue: http://www.vbulletin.com/forum/forum...d-all-versions

All times are GMT. The time now is 11:50 AM.

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.02648 seconds Memory Usage 1,710KB Queries Executed 10 (?)
More Information
Template Usage: (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)post_thanks_navbar_search (1)printthread (3)printthreadbit (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit showthread	Included Files: ./printthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/class_bbcode_alt.php ./includes/class_bbcode.php ./includes/functions_bigthree.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete printthread_start bbcode_fetch_tags bbcode_create bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete printthread_post printthread_complete
Messages: