How long

Want the title?

Hack the forum (shouldn't be too hard to find a kidi script exploit), give yourself admin, make a new membership group, put yourself into it, remove yourself from admin.

See?  Easy.

I lol'd. It's script kiddy.

And I did 6/1 in my CHRISTMAS thread in RM.

Quote from: Dino Piranha on June 16, 2010, 02:58:33 PM

Quote from: Lorddave on June 16, 2010, 02:56:34 PM

6/1?

On June 1, 2010, the site was hacked so that every forum used the Christmas theme seen in Random Musings. It was really quite amusing.

That wasn't really a hack.  That was just an exploit of the way SMF commits user's themes to memory.  8/30 was a real hack and is the one we should all nevar forget.

Fine, but I know that I shall nevar forget 6/1.

XSS errors due to the polls could cause a real hack.

Well, I had an SM forum hacked a while back.  Saved the code just because.

Anyway, apparently PHP will read code from any source, even an image file.  The hackers hacked an image file, gave it a header then filled the rest with SQL code.  They then created an account, uploaded the image as their avatar, and when anyone looked at the thread, the code executed.

I'm not sure exactly if it could run with anyone or if an administrator had to view it for the permissions but in any case, it inserted code into the Database, gave someone superadmin, and they were able to do anything they wanted.

So just saying...

On server avatar uploads = Bad.

I'm not sure if that still exists in SMF 1.1.11. I'm pretty sure that one was taken care of.

I'm not sure if that still exists in SMF 1.1.11. I'm pretty sure that one was taken care of.

I can test it.  MWAHAHAHAH!

Quote from: SupahLovah on June 18, 2010, 04:17:32 PM

I'm not sure if that still exists in SMF 1.1.11. I'm pretty sure that one was taken care of.

I can test it.  MWAHAHAHAH!

enjoy your ban.

Quote from: Lorddave on June 18, 2010, 05:39:10 PM

Quote from: SupahLovah on June 18, 2010, 04:17:32 PM

I'm not sure if that still exists in SMF 1.1.11. I'm pretty sure that one was taken care of.

I can test it.  MWAHAHAHAH!

enjoy your ban.

Why?
I haven't done anything except proclaim my ability to do something.