Re: PHP Exploit via phpBB?

John Nichel wrote:

I haven't fully researched it yet, but our domains were just hacked, and from the looks of it, the attack came in thru phpBB. This morning, around 9:00am, I upgraded our webserver to php v4.3.10 from v4.3.9 due to potential security risks, and at 11:30 it looks as if the attack started. By 11:48, all of the php pages, on all of our domains were replaced by one like this... http://john.nichel.net I don't know if this is a PHP problem or a phpBB problem as of yet, but I wanted to get the word out here so that y'all can take precautions if neccessary. I disabled the system() function on our box, and may need to take further action as I discover more.

You're missing the fact that you need to read phpBB's web site from time to time. -- W | I haven't lost my mind; it's backed up on tape somewhere. +-------------------------------------------------------------------- Ashley M. Kirchner <mailto:ashley@pcraft.com> . 303.442.6410 x130 IT Director / SysAdmin / Websmith . 800.441.3873 x130 Photo Craft Laboratories, Inc. . 3550 Arapahoe Ave. #6 http://www.pcraft.com ..... . . . Boulder, CO 80303, U.S.A.