I didn't hear any sounds, and from what I've seen it doesn't appear to be sending anything anywhere, just writing that text
Edit: http://www.whois.sc/sanaldevrim.net
Yay for Turkish registars!
You are not logged in. Please login or register.
PunBB Forums → Posts by Smartys
I didn't hear any sounds, and from what I've seen it doesn't appear to be sending anything anywhere, just writing that text
Edit: http://www.whois.sc/sanaldevrim.net
Yay for Turkish registars!
rofl
Not malicious, trying to be 1337 (at least as far as I see)
The text it displays:
<!--#include file="database.asp"-->
<!--#include file="Server-CreateObject.asp"-->
<%
If hacked.eof then
Response.Write (" This Web Page Hacked ")
Response.Write (" Hacked by ALTANs ")
Response.Write (" RSA key fingerprint : 4f:b8:e8:83:h7:82:1g:t4:2e:49:72:41:f2:19:66:ea ")
Response.Write (" Are you sure you want to continue connecting (yes/no)? ")
Response.Write (" yes ")
Response.Write (" Root: ALTANs ")
Response.Write (" password: ******* ")
Response.Write (" Md5 : 3f3082fd88c694198de78162285940bf ")
Response.Write (" Checksum : --->> Game Ower :) ")
End If
%>
www.SanalDevrim.net
altan@sanaldevrim.net
Edit: Now then, lets see what their hosting company says about that site
Mmm, I just noticed that it gives the administrator the Banned tag in the forums
And now all mods that use it just have to be updated
Well, I was bored, found out where he had that image hosted, and emailed their abuse email
Thank you for informing us. The site has been terminated.
Regards,
Domain DLX Abuse Department
Small victory, but I was bored
Instead of the array, and having to update a mod whenever a new version comes out, how about something like this:
If the minor version is different from every element of the array, (ie: it says 1.2.5 but you have 1.2.7) you just get a warning that it may not work properly. This is good, especially since Rickard almost never changes database structure in between versions.
If the major version is different (ie: the array says 1.1.5 but you have 1.2) then you get the error that you currently get.
That way, people who make mods that need install_mod.php don't need to update the mod every time a new version of PunBB comes out unless they want to get rid of the warning, or if it somehow doesn't work.
Mmm, I'm not sure exactly what the problem is
Do the forums and the categories still exist in the database? Do the topics? Do the users?
If you want to send me a dump, I can take a look at it and see what you need to do (email is smartys@gmail.com)
lol
You should change it in the database (in the config table) and then remove the cache file
By randomly ban people, I mean that I could put in usernames that don't yet exist, and if a person registers with it they get banned
Except admins can't be banned
What's your site's URL?
I mean, it checks it properly up here
if (isset($_GET['add_ban']) || isset($_POST['add_ban']))
{
// If the id of the user to ban was provided through GET (a link from profile.php)
if (isset($_GET['add_ban']))
{
$add_ban = intval($_GET['add_ban']);
if ($add_ban < 2)
message($lang_common['Bad request']);
$user_id = $add_ban;
$result = $db->query('SELECT group_id, username, email FROM '.$db->prefix.'users WHERE id='.$user_id) or error('Unable to fetch user info', __FILE__, __LINE__, $db->error());
if ($db->num_rows($result))
list($group_id, $ban_user, $ban_email) = $db->fetch_row($result);
else
message('No user by that ID registered.');
}
else // Otherwise the username is in POST
{
$ban_user = trim($_POST['new_ban_user']);
if ($ban_user != '')
{
$result = $db->query('SELECT id, group_id, username, email FROM '.$db->prefix.'users WHERE username=\''.$db->escape($ban_user).'\' AND id>1') or error('Unable to fetch user info', __FILE__, __LINE__, $db->error());
if ($db->num_rows($result))
list($user_id, $group_id, $ban_user, $ban_email) = $db->fetch_row($result);
else
message('No user by that username registered. If you want to add a ban not tied to a specific username just leave the username blank.');
}
}
However, when you're adding advanced settings, username isn't checked. That means you can ban an administrator (kind of, bans don't affect admins) or just randomly ban people.
And on that subject, the message about banning admins is redundant, since banning doesn't work on admins anyway: the check_bans function has
// Admins aren't affected
if ($pun_user['g_id'] == PUN_ADMIN || !$pun_bans)
return;
Mmm, PunRes seems to have the same issue
Just ban hcgtv.net in the email?
Have them sign up here and see if they have the same issue (I have Outlook 2002)?
And you can change the folder in PunBB if you have a problem
The English language pack is part of the full download
Where is the site? Is the language pack actually in the right place (lang/English), and are all the files in the folder there and uncorrupted?
You don't need it modified, you just unset posting permissions for the group
Nope, there isn't an option to make a group the moderators of a certain forum
Why do you say it will fail? stream_set_timeout? That's easy enough to get around
Yes, but shouldn't you use urlencode or something on it?
If by "the vulnerability" you mean the one in search, yes
If you mean the ones in the admin interface, I'd have to check, but I don't think it matters
If I use an unencoded space in my website (say, if I make my website http://forums.punbb .org), it messes up the display of the Website link in Firefox (it doesn't look like a link) and simply makes a non working link in IE. I assume that has to do with the fact that I didn't use %20 or something like that
PunBB Forums → Posts by Smartys
Powered by PunBB, supported by Informer Technologies, Inc.