Thread Rating:
  • 0 Vote(s) - 0 Average
  • 1
  • 2
  • 3
  • 4
  • 5

why or by which plugin Mybb hacked?

#1
Hy Darth Hy folks, the forum was hacked once by an insecure plugin, which one was that? mydropzone plugin or?
Why I ask, strangely enough, are the previously paid plugins offered for free

MyDropzone
Symposium
ENdless
Drafts Autosafe
Default Message

lg Tc4me
 [Image: autism4all.png]
[x] <= Drive in nail here for new display!
Reply
#2
If I recall it was the Hovercard plugin
Reply
#3
Okay Thank You
 [Image: autism4all.png]
[x] <= Drive in nail here for new display!
Reply
#4
Yes, hovercards was the plugin that got us. There was another one that was vulnerable as well. I don’t remember exactly which one it was (I’ll look back through the messages and get back to you). They were notified multiple times when it was discovered.

Update: It was the drafts auto save plugin. Checked back today, still does not appear to have been patched. Sent another message to the MyBB team about it today.
Saturn-Moon.com - Our next project...
Reply
#5
oh, take a look at 
hovercards https://community.mybb.com/mods.php?acti...d&pid=1441
and here 
Drafts Auto Save https://community.mybb.com/mods.php?acti...d&pid=1438

Angry
 [Image: autism4all.png]
[x] <= Drive in nail here for new display!
Reply
#6
I just made them aware again, they will probably address it shortly. Don’t install the drafts auto save yet. Hovercards has already been patched.

MyDropZone and Symposium are safe too I believe. I audited those a while back. Not sure about any of the other ones, haven’t audited all of them yet.
Saturn-Moon.com - Our next project...
Reply
#7
ok Thank you, I'll keep waiting before I try, thank you
yes Ben throws out one plugin after the other, is he in a good mood or bored?
 [Image: autism4all.png]
[x] <= Drive in nail here for new display!
Reply
#8
Did some digging and research on this one. The plugin is no longer vulnerable. It turns out it was evidently patched at some point as a fly-by-night thing, with absolutely no change to the version, date, or timestamp. No idea when exactly it was patched, it was done at some point after this August with no mention of it publicly.
Saturn-Moon.com - Our next project...
Reply
#9
That’s already very good, thank you Darth-Apple for your commitment,
 [Image: autism4all.png]
[x] <= Drive in nail here for new display!
Reply


Possibly Related Threads…
Thread Author Replies Views Last Post
Sad Why are the many errors in the forum not fixed? tc4me 5 410 March 16th, 2021 at 7:34 PM
Last Post: tc4me
  [MyBB Plugin] Board Announcements Manager (For 1.6 and 1.8) Darth-Apple 49 42,047 January 28th, 2021 at 11:38 AM
Last Post: tc4me
  [MyBB Plugin] Average Profile Ratings Darth-Apple 8 1,916 October 22nd, 2020 at 6:41 AM
Last Post: tc4me
  Simple Reputation Bars [MyBB Plugin] Darth-Apple 7 1,124 October 22nd, 2020 at 4:25 AM
Last Post: tc4me



Users browsing this thread: 1 Guest(s)

Makestation Theme/Design Selector

Contact Us | Makestation | Return to Top | Lite (Archive) Mode | RSS Syndication 
Proudly powered by MyBB 1.8, © 2002-2021
Forum design by Makestation Team © 2020
Saturn-Moon.com - a modern day time capsule | Makestation Ajax Chat Hosting