Can someone do this?

[nine.seven]

Umm.. I got this completely random voicemail this morning and I'm wondering if what he is saying is true?

http://img159.imageshack.us/my.php?i...icemaileg8.swf

Log:
Message received at 4 17 am
Hello hello David, Parker
My name would be, Hairy John
Ok
and I was just called to let you know
that i found a
fewwww
exploits in ur website
a little bit of SQL injection

dunno what he says here really
umm ill be doing a mb5 hash
that will be giving me your admin password

i would so kindly be taking that website over
in a couple hours
if u would like to go on and take a look
you have a great day


I haven't noticed anything wrong with my forums, and I don't remember installing anything weird. I am not professional at it or anything but I know my way around PHP and vbulletin (so I doubt I messed something up like that).

Only thing that has been different in a week or 2 ago I got some vbulletin errors (this was the email.. I got 8 in a row same minute.. All had a different image.. image is users avatars):

Database error in vBulletin :

mysql_connect() [<a href='function.mysql-connect'>function.mysql-connect</a>]: User [user] already has more than 'max_user_connections' active connections
/555/555/555/555/forums/includes/class_core.php on line 274

MySQL Error :
Error Number :
Date : Thursday, February 14th 2008 @ 08:07:29 AM
Script : http://555/forums/image.php?u=96&amp;dat...ine=1200931676
Referrer :
IP Address : 69.89.55.55
Username :
Classname : vb_database

[Boofo]

First, how did he get you phone number? Second, if he was really gonna do as he said, he would have done it and THEN maybe called you or left his calling card on your site. Sounds to me like it is someone you know or who knows you.

Who's IP address is that in the error?

[iogames]

Originally Posted by Boofo

Sounds to me like it is someone you know or who knows you.

Who's IP address is that in the error?

Once that we agreed on that: 'What did you do to him?'
IP: 69.89.55.55 = San Mateo, CA.

[bobster65]

Originally Posted by Boofo

First, how did he get you phone number?

Would be easy if they have it on their domain record. Private domains are the way to go

[iogames]

Originally Posted by bobster65

Would be easy if they have it on their domain record. Private domains are the way to go

we need more info on this

[Adrian Schneider]

David,

Unless you have any custom code on your server (PHP) then you should be safe from any injection. The DB error is just from a restriction set by your host which you can get around if you have multiple database accounts.