<![CDATA[PunBB Forums - Account still getting created despite new account being OFF]]> http://punbb.informer.com/forums/topic/21486/account-still-getting-created-despite-new-account-being-off/ Sat, 11 Apr 2009 20:09:57 +0000 PunBB <![CDATA[Re: Account still getting created despite new account being OFF]]> http://punbb.informer.com/forums/post/126726/#p126726 What are the webserver logs saying? Check their I.P against the logs and see what they're doing.

]]> Sat, 11 Apr 2009 20:09:57 +0000 http://punbb.informer.com/forums/post/126726/#p126726 <![CDATA[Re: Account still getting created despite new account being OFF]]> http://punbb.informer.com/forums/post/126721/#p126721 Well, I can confirm that accounts get created even without the register.php script.

I /I/ try to register a new account with the link, I get 404, but somehow the bots have a way around it and can create a new account AND post.

Help !

]]> Sat, 11 Apr 2009 14:56:14 +0000 http://punbb.informer.com/forums/post/126721/#p126721 <![CDATA[Re: Account still getting created despite new account being OFF]]> http://punbb.informer.com/forums/post/126720/#p126720 Yes I had a forum.old, but it's not publicised in an index... I moved it off to see if it helps. How could they reach a directory that is not indexed ?

In fact, I had renamed the register.php register.php.bak and I still got accounts creation.. Could it be some sort of SQL injection ?

]]> Sat, 11 Apr 2009 14:00:55 +0000 http://punbb.informer.com/forums/post/126720/#p126720 <![CDATA[Re: Account still getting created despite new account being OFF]]> http://punbb.informer.com/forums/post/126718/#p126718 So new registrations are disabled? Have you got an old backup/version of the forums still knocking about somewhere on the webserver, perchance?

]]> Sat, 11 Apr 2009 13:23:12 +0000 http://punbb.informer.com/forums/post/126718/#p126718 <![CDATA[Account still getting created despite new account being OFF]]> http://punbb.informer.com/forums/post/126715/#p126715 Bots are creating users on my forum despite me having disabled new creations. I also changed the cookie to something random, to no effect.
I think they found a way to fake the account confirmation email or something, but they entirely bypass the register page.

Anyone has seen this ?

Any fix ?

I'm running 1.2.21, with very very little tweaks.

]]> Sat, 11 Apr 2009 12:10:34 +0000 http://punbb.informer.com/forums/post/126715/#p126715