Hehehe rice message board got haxor3ded

[Byte]

http://www.thevboard.com/

 

[BW86]

 

[hevnsnt]

haha NO GRRETZ

 

[SportSC4]

it looks like they were using phpbb... probably an older version.
edit: just checked, they were using 2.0.8. current version is 2.0.10

it seems that the group was pretty malicious with that board. the worst that has ever happened with the board i admin is they replace the headers, footers and greeting message. i guess i should be on the lookout if they're making their annual rounds... sigh.

 

[hevnsnt]

Latest is 2.0.10 modded ... 2.0.10 is vulnerable without some easy changes


Open viewtopic.php in any text editor. Find the following section of code:

//
// Was a highlight request part of the URI?
//
$highlight_match = $highlight = '';
if (isset($HTTP_GET_VARS['highlight']))
{
// Split words and phrases
$words = explode(' ', trim(htmlspecialchars(urldecode($HTTP_GET_VARS['highlight']))));

for($i = 0; $i < sizeof($words); $i++)
{

and replace with:

//
// Was a highlight request part of the URI?
//
$highlight_match = $highlight = '';
if (isset($HTTP_GET_VARS['highlight']))
{
// Split words and phrases
$words = explode(' ', trim(htmlspecialchars($HTTP_GET_VARS['highlight'])));

for($i = 0; $i < sizeof($words); $i++)
{

 

[MercenaryForHire]

Originally posted by: hevnsnt
Latest is 2.0.10 modded ... 2.0.10 is vulnerable without some easy changes


Open viewtopic.php in any text editor. Find the following section of code:

//
// Was a highlight request part of the URI?
//
$highlight_match = $highlight = '';
if (isset($HTTP_GET_VARS['highlight']))
{
// Split words and phrases
$words = explode(' ', trim(htmlspecialchars(urldecode($HTTP_GET_VARS['highlight']))));

for($i = 0; $i < sizeof($words); $i++)
{

and replace with:

//
// Was a highlight request part of the URI?
//
$highlight_match = $highlight = '';
if (isset($HTTP_GET_VARS['highlight']))
{
// Split words and phrases
$words = explode(' ', trim(htmlspecialchars($HTTP_GET_VARS['highlight'])));

for($i = 0; $i < sizeof($words); $i++)
{

Curious.

- M4H

 

[RossMAN]

http://www.phpbb.com/phpBB/vie....php?f=14&amp;t=240636