Version 3.6.6. | Exploit is out?

[Shazz]

Originally Posted by dadu911

Yep one from 2 weeks ago. We hit 103,000 users but nope now we are back to 97,000 because we got exploited and thats that.

Hopefully VB will test out their software fully before releasing to the public. Any who thanks for the updated version.

ALWAYS BACK UP - Lesson well learned.

Thats a ton of users lost :erm:
Sorry for the loss

[dadu911]

THERE IS A HOLE IN Latest Version: 3.6.7 PL1 ALSO!!! THEY CAN LOGIN AS ADMIN!!! MAN VBULLETIN HELP

someone logged in as admin, has changed the password and turned the forum off. He placed his url so he gets the hits.

This is SAD! Yet again another hole in VBULLETIN!

[Dismounted]

I would say not. Disable all your hacks and change FTP, cPanel, and MySQL passwords.

[Paul M]

Originally Posted by dadu911

THERE IS A HOLE IN Latest Version: 3.6.7 PL1 ALSO!!! THEY CAN LOGIN AS ADMIN!!! MAN VBULLETIN HELP

someone logged in as admin, has changed the password and turned the forum off. He placed his url so he gets the hits.

This is SAD! Yet again another hole in VBULLETIN!

What hole would that be then ?

You have not offered any proof that any of the exploits of your server were via vbulletin, you've just conviently decided that a previously unknown XSS in in the events area was used, which is actually highly unlikely. It helps to actually have evidence before making wild accusations.

[dadu911]

Lol Man I was right before and I am right again. Give it another 24 hours, VB will announce a new version cause another security issue!

This time this exploit works like this:

They can login as admin, turn off forum and redirect to another site.

This is a brand new exploit and hasn't been a security fix for it yet!

[Shazz]

Originally Posted by dadu911

Lol Man I was right before and I am right again. Give it another 24 hours, VB will announce a new version cause another security issue!

This time this exploit works like this:

They can login as admin, turn off forum and redirect to another site.

This is a brand new exploit and hasn't been a security fix for it yet!

[high]* Shazz looks into vbulletin.com[/high]

[sonichero]

*sees patch for 3.6.7...

...oh bugger...

[dadu911]

I already have: vb 3.6.7 PL 1 and I got exploited L.O.L

I did a full upgrade. the guy keeps doing it.

[Shazz]

Originally Posted by dadu911

I already have: vb 3.6.7 PL 1 and I got exploited L.O.L

I did a full upgrade. the guy keeps doing it.

Did you read what Paul M posted a few posts ago?

Originally Posted by Paul M

What hole would that be then ?

You have not offered any proof that any of the exploits of your server were via vbulletin, you've just conviently decided that a previously unknown XSS in in the events area was used, which is actually highly unlikely. It helps to actually have evidence before making wild accusations.

[El_Muerte]

once you've been compromised you need to change all your admin and system (e.g. database, shell, etc) passwords.
there's a fair chance that your forum got compromised because of a weak admin password, otherwise there would be much more reported compromises.
all versions prior to 3.6.7 were exploitable, not just 3.6.6