Quote:
Originally Posted by Shadab
If the hacker has access to your vBulletin Forum's admin account and it's a Super Administrator account and/or has the permissions to 'manage' plugins; then yes, he can alter/create files on your server. Doesn't matter if you have 3'rd party addons installed or not.
So; Stock vBulletin or not, if he gets access to your admin account, theres nothing stopping him to create his own plugins from your account to run raw PHP code on the Forum. (unless of course that particular admin account doesn't have the permission to alter plugins).
|
Thats what i thought and sounds like that is exactly what happened as i can see from the log that the first thing he did was something with plugins..
17838 Python 18:04, 19th Apr 2009 plugin.php productedit
17837 Python 18:03, 19th Apr 2009 plugin.php product
.. is there a way to find out which one was altered?
04-21-2009, 04:23 PM
Hybrid Mode
