Another website hacked by Yusuf Kara

I know a fair bit about computers, but not much about programming forums etc. My forum is http://www.cornelsworld.com/forum. Is there a way I can get it back to normal? Is there somewhere I can look to find out how to fix it? Please help as I would rather not restart the forums and have everyone reregister on the forums?

Thanks for any help you can give.

Also, did this person get my password, or did he find a flaw in the programming?

Greg West

Anyone?

What version of phpBB are you using?

Good Day,

I hope that I am posting in the correct area, as I would like to report a security issue.

I have been using phpBB2 for about three years, and I must say it rocks. Completely easy to use, and the funcionality of the board is fantastic.

Forgive me if I do not post exactly what you need, however I am not too technically savvy. Feel free to contact me for further. In brief:

My cousin installed this board on my website, www.NoLimitHonkey.com/phpBB2

Was working fantastic. Today I attempted to log in to my board for maintenance, and I noticed someone hacked in and left some banter. I am not familiar with how to change this back - if at all. I checked in the admin panel to see if I could change the index back, but I found nothing. I also realized I'm an idiot and I shoudl have backed it up using the back up option. PLEASE tell me I am not SOL, and that you may be able to bring it back up. In addition, what updates can you suggest to stop this from happening again?

Upon further investigation, I have noticed that This hit very many of your boards.
The "Yusuf KARA" attack, that is.

I am in the same boat as this gentleman: http://www.phpbb2.de/ftopic33465.html

What are my options for correcting this? Do I have to do a complete reinstall?

BJ LANGE
www.NoLimitHonkey.com
314.504.8361 - Mobile (USA)

phpBB2.de User Anmeldungsdatum: 29.11.2005 Beiträge: 1

I am not sure weather you got the solution of this or not but as i recently got this attack and reading one of the threads here i corrected that.

You need to have go to your database and find table named 'phpbb_forums'. Reember phpbb_ is the prefix of the table you may have some other. Then search for forum that is not created by you should be the last forum. In description of that forum that guy has put the text that does all this. Delete that forum and your site should work. That guy deleted my admin account as well so i recreated it logged into admin panel and changed my site name back to normal.

But this will only solve this thing for now and can happen again i am not sure how that guy did this and how he logged into my admin panel. There must be some security problem in phpBB. I am looking into it and anyone of you knows about it please advise.

pre-thanks

Atiq

phpBB2.de User Anmeldungsdatum: 06.08.2002 Beiträge: 1628 Wohnort: Hannover

Go to phpmyadmin, click on phpbb_config, change the fields sitename, site_desc and cookie_name. They have placed an IFRAME in there ...

phpBB2.de User Anmeldungsdatum: 26.10.2006 Beiträge: 2

Why don't you also use htpasswd to protect your admin directory?

http://www.ilovejackdaniels.com/apache/password-protect-a-directory-with-htaccess/
Page 2 has a password generator to make it easy.