phpBB.com HACKED!!

[ChrisChristian]

Bad News for phpBB users:

So far, the phpbb.com remains offline.

*** Removed link and content of this post. We do not need to link to websites ran by hackers or list passwords of another site. ***

[lasto]

sad news indeed

[ChrisChristian]

It´s very unfortunate. I hope they get everything sorted.

[UKBusinessLive]

Well all i can say is that i hope they sort this out asap, Its a nightmare when something like this happens, it feels like you've been robbed. What was the whole point of this??, Very Sad indeed

[UncoderMom]

I hope they get it sorted too.

OMG, is that the hacker posting copies of its user database to rapid share????

[Shazz]

Just be fortunate that you don't have a phpbb forum, this would be good for jelsoft... More potential customers

[klaush]

They used a security hole in phplist.

If anyone use this newsletter tool, here is the fix for this hole:

security update version 2.10.9
29 January 2009

We've released version 2.10.9 that fixes a local file include vulnerability.This vulnerability allows attackers to display the contents of files on the server, which can aid them to gain unauthorised access.

Everyone using any version up to this one is advised to upgrade as soon as possible. Any clients hosted by Tincan have already been patched or upgraded.

If you don't want to upgrade now, you can fix the vulnerability quickly by adding the following line to the top of the index file in the admin directory:

----------

if (isset($_REQUEST['_SERVER'])) { exit; }

http://www.phplist.com/?lid=274

[Shelley_c]

Originally Posted by UncoderMom

I hope they get it sorted too.

OMG, is that the hacker posting copies of its user database to rapid share????

Looks like it and much more. Shame, people like this are full of beans until they are caught & prosecuted and blubber like little babies. Shame, I'm sure they will be back to business before long a little wiser in the process.

[Winterworks]

Originally Posted by UncoderMom

I hope they get it sorted too.

OMG, is that the hacker posting copies of its user database to rapid share????

He did, but visit the link now and it's...

This file is suspected to contain illegal content and has been blocked. After the file has been blocked for 7 days it will automatically be deleted, if the block is not removed by RapidShare. For this reason, a download of this file is currently not possible.

[ChrisChristian]

Info from AREA51 (phpbb dev forum):

by Erisar ? Today 5:27 am
phpBB.com is offline due to a security vulnerability in PHPList, a third party software being used on the site. The phpBB3 software is not responsible and is not compromised in any way. phpBB.com will be offline until the problem can be fixed. Support may continue as usual in the temporary support forum or on IRC (#phpBB on irc.freenode.net). We thank everyone for your patience and understanding.