PHP Bug

Started by aRedMoon December 20th, 2004 10:22 PM
  • 714 views
  • 8 replies

aRedMoon

Wait for me outside the lines

Age 34
Male
Minnesota
Seen April 23rd, 2018
Posted September 10th, 2013
11,126 posts
19.2 Years
o.o A forum I go to got hacked this way. o.O

Recently a serious exploitable issue was discovered in PHP (the scripting language in which phpBB, IPB, vB, etc. are written) versions prior to 4.3.10. The problematical functions include unserialize and realpath. phpBB (along with a great many other scripts including IPB, vB, etc.) use these two functions as a matter of course.

It has come to our attention that code has now been released which uses this exploit in PHP to obtain confidential information in phpBB. Such information includes data contained in phpBB's config.php file. We therefore recommend the following:

1) If you maintain your own server be sure to upgrade to the newest available release of PHP (both versions 4 and 5). Be aware that at this time phpBB 2.0.x has problems functioning under PHP5 without modification.

2) If you pay for hosting ensure you hosting provider has upgraded thier installation of PHP (again remember that phpBB 2.0.x and other scripts will not function under PHP5 without modification).

Please do not submit this PHP issue to our security tracker, it is beyond our control. Fixed versions of PHP do exist and as above we encourage you to ensure your system is running such a version. Equally please examine any "hacking" issues you have carefully to ensure they are not caused by this PHP problem (rather than phpBB). Remember, this is not a phpBB exploit or problem, it's a PHP issue and thus can affect any PHP script which uses the noted functions.
So yeah, if you run a server, update! o.o!
facebook \\ twitter \\ blog a.k.a life // tumblr // google+

june 10, 2003 = registered at old pc
march 24, 2004 = registered at new pc
june, 2004 = modded ;;; august, 2004 = quit/fired (point of debate)
december, 2004 = banned ;;; december 2, 2005 = unbanned
june 10, 2008 = omg... five years!
june 10, 2012 = countdown to nine years on pc...
Age 32
www.pokedrome.info
Seen March 28th, 2005
Posted March 12th, 2005
1,778 posts
19.1 Years
Umm.....How did you find this!This is Interesting!
I am PCs one & only CC

Visit Pokemon Gaming Sphere We have just about anything you need on
-- Rom-Hacking Pokemon Games Pokemon Movies Webmasters Section Amazing Emulators& Downloads All needed sprites Hacks & many more.
Its the Newest & Hottest domain for your Needs.
[img=http://img226.exs.cx/img226/686/pgs5cl.png]


My Hack
Pokemon ThunderStar
has got the best Hack of the month award and has been stickied. Go visit the thread and Give your feelings about it.


Evil Twins with mvtm | Paired up with no one| Senior Member of Dark Xeno Revolution inc

Im seriously not able to keep up with my New Year Resolution of not joining any club. Toooo many Clubs here are tempting me.
Age 37
Seafoam Island
Seen February 2nd, 2010
Posted February 2nd, 2010
3,537 posts
19.7 Years
I saw that and a buddie explained to me what it was about. I saw a few rather large anime sites temp. shutdown to repair there servers.

------------------
I came here as a and will always be one.
------------------
PC Family | Pair of Angela | Twin of Sammi | Chi Cousin of Midori Chi
------------------
Seafoam Island - PC Community Site - Pokemon International Forums - Seafoam Island Forums
Seafoam Island Oekaki - Seafoam Island Topsites - Join ShiningMisdreavus Chat!

aRedMoon

Wait for me outside the lines

Age 34
Male
Minnesota
Seen April 23rd, 2018
Posted September 10th, 2013
11,126 posts
19.2 Years
[email protected]]Umm.....How[/email] did you find this!This is Interesting!
http://www.phpbb.com

._.

Yeah, it's quite a shocker. x.x
facebook \\ twitter \\ blog a.k.a life // tumblr // google+

june 10, 2003 = registered at old pc
march 24, 2004 = registered at new pc
june, 2004 = modded ;;; august, 2004 = quit/fired (point of debate)
december, 2004 = banned ;;; december 2, 2005 = unbanned
june 10, 2008 = omg... five years!
june 10, 2012 = countdown to nine years on pc...

usami

biohazard

Age 32
Male
Iowa
Seen October 5th, 2021
Posted May 1st, 2014
7,305 posts
19.5 Years
It's not just a bug. It's a worm. I counted over 300 sites hit, with about 20 more pending in this list I found.
http://zone-h.org/defacements/onhold

It looked like this is a collaboration of hacking groups, and I don't want to know what size that is.
If you click on the links there they've been hacked already. Evil hackers x.x

aRedMoon

Wait for me outside the lines

Age 34
Male
Minnesota
Seen April 23rd, 2018
Posted September 10th, 2013
11,126 posts
19.2 Years
Erica linked to the wrong thread. XD

http://pokecommunity.com/showthread.php?t=25657

That's the one about the worm. ^^;
facebook \\ twitter \\ blog a.k.a life // tumblr // google+

june 10, 2003 = registered at old pc
march 24, 2004 = registered at new pc
june, 2004 = modded ;;; august, 2004 = quit/fired (point of debate)
december, 2004 = banned ;;; december 2, 2005 = unbanned
june 10, 2008 = omg... five years!
june 10, 2012 = countdown to nine years on pc...
Age 32
www.pokedrome.info
Seen March 28th, 2005
Posted March 12th, 2005
1,778 posts
19.1 Years
Like this is Dead Bad..I just saw the link the guys posted...
Thousands of Forums Were Lost Fully...Will be a Big shock for the Owner and PHPBB are in a fix...I hear they are going to get a new patch...

And I know some Forums with more than 15000 Members Got hacked!
I am PCs one & only CC

Visit Pokemon Gaming Sphere We have just about anything you need on
-- Rom-Hacking Pokemon Games Pokemon Movies Webmasters Section Amazing Emulators& Downloads All needed sprites Hacks & many more.
Its the Newest & Hottest domain for your Needs.
[img=http://img226.exs.cx/img226/686/pgs5cl.png]


My Hack
Pokemon ThunderStar
has got the best Hack of the month award and has been stickied. Go visit the thread and Give your feelings about it.


Evil Twins with mvtm | Paired up with no one| Senior Member of Dark Xeno Revolution inc

Im seriously not able to keep up with my New Year Resolution of not joining any club. Toooo many Clubs here are tempting me.