Vbulletin.com hacked

[squidsk]

Originally Posted by Skyrider

According to many sites, it was:



and



As such he had shell access. Hence my question still stands .

You do realize that if due to the security issue he was able to execute arbitrary code on the server he could give himself shell access, so whether or not he ended up with shell access is irrelevant since it wasn't the shell access itself that was the access point for the breach, which is exactly what Paul was saying.

This would be like worrying about whether the door to your house is well enough protected when the thief came in from the window but was removing items from the door once they were inside.