Updates: page: 3
Page 3 of 5 · <1 ... 2 3 4 ... 5 >
-
21/12
Security risk with phpBB boards
Following personal experience of such an attack, I thought I’d quickly mention this here so that, hopefully, I can prevent anyone else from undergoing the same fate!
As you can read here and here, there’s currently a rampant worm that’s seeking and exploiting older versions of phpBB bulletin boards. Once its attacked, your will usually see the following message on all pages with .html and .php extensions:
This site is defaced!!!
NeverEverNoSanity WebWorm generation [xx].
(Please note that the generation number can vary.)
At the moment it’s still not clear whether or not this is a security problem with the board itself or if it’s with PHP version 4.3.9, but advice at the moment is to ensure that your board is running on the latest version 2.0.11 of PHPBB in order to try and minimise attack. I’d also suggest backing up your board and site just in case.
I would imagine that there are quite a number of people who read this who may use this BB, so I hope that someone finds this useful!
V xx
December 21, 2004 | 
By Vixx | 
Comments Off | 
Filed under General, Updates
-
13/12
Terms of Usage change – please read!
Please note that the terms of usage for all Codegrrl scripts and tutorials have been updated.
With immediate effect, in no way are you permitted to install any versions – modified or not – of the Codegrrl scripts for any charge without prior written permission of the script author.
Codegrrl is a linkware site. All scripts here are available for download for free, were written by their authors for free, distributed without charge and free support is available for all of them at the forums. All we ask for is a link back to this site to say thank you. As offering optional paid installations is the only way most of our script authors get anything back for their scripts, when other people charge for installations they are taking work away from the scripts’ authors – something we will now no longer permit without the script author’s express permission. Remember that by hiring the author for the paid installation you are helping to keep CodeGrrl alive and encouraging them to keep working on the scripts and this site!
If you notice anyone offering the scripts for paid installation and you suspect that they do not have our permission for this, please let us know!
Thanks in advance for your co-operation with this.
December 13, 2004 |
By Vixx |
Comments Off |
Filed under General, Updates
-
17/08
About the Build A Blog tutorial
Actually this is about ALL of the tutorials on CodeGrrl.
I was helping someone with the Build A Blog tutorial recently, and I realized that one of the big problems she was having was that she was pretty much just copying the code from the end of each tutorial. In doing this, she actually overwrote other changes that were important to her site.
This is not how tutorials are supposed to work. The point of a tutorial is not to do the code for you, but to teach you how to do it yourself.
Please read the tutorials and try to learn from them. And if you have any questions, we’re here to help.
If you’d like to discuss this entry, please post in this Tutorials Forum thread.
August 17, 2004 |
By Michelle |
Comments Off |
Filed under Tutorials, Updates
-
12/04
This message is aimed at everyone who has converted their website to PHP using the index.php?x=about.html method to include their pages, as seen in many tutorials all over the web.
This method is very insecure, and allows hackers to gain access to your server. Because you are specifying what file to include via a URL, anyone can change the bit after x= to something else to include any file they want. This means they are able to see sensitive files, that hold password and other sensitive information. Once a hacker has gained access to your server, they will generally proceed to upload malicious scripts (like trojans or egg drops), with which they can attack other networks and send out SPAM emails. This eats up the bandwidth and disk space you’re paying for, and can get you kicked out by your host. And, even worse, if any damage is caused to the server you’re hosted on, your host can hold YOU totally responsible for those damages, because you allowed the hackers to gain access by using insecure coding! If they wanted to, they’d have the right to sue you over this.
I’ve discovered this because several friends of mine recently contacted me after having problems with hackers on their servers. In trying to figure out what let the hackers gain access, I discovered the insecurities in this script. Also, one of those friends noticed she had been getting a lot of referrals from Google.com for searches looking like “allinurl: index.php?x=”. This means that there are people out there specifically looking for sites using these scripts, they are being targeted by hackers because it is KNOWN these sites are insecure.
Therefore, it is VERY important that you change your coding ASAP, as in RIGHT AWAY, if you were using this method of PHP coding. Here’s what you should do if you used this script:
-
Change your passwords for your domain control panel and MySQL databases. It can’t hurt to change your password to your email accounts as well, just in case.
-
Change your coding. There are other ways of converting your pages to PHP, two examples of which can be found here:
NL-ConvertToPHP
Fitting In With Your Site -
Make sure there are NO urls left in your site anywhere that use the “?x=filename.html” method to include files.
-
Contact your host, and explain to them that you’ve just discovered you were using a script that wasn’t completely secure. Tell them that it might have let hackers gain access to the server. Your host will then be able to run a security check on the server to get rid of any malicious scripts that might be present if you have been hacked.
-
Spread the word. It’s very important we let as many people as possible know about this ASAP so they can protect themselves. Please post about this in your blogs, forums, mailing lists, LiveJournals, etc. If you know of anyone who has a tutorial up on how to implement this method, please send them a link to this thread. The more people read this, the more will hopefully be able to change their coding before they get hacked. Feel free to include this entire message, or alternatively, include a link to the thread about this at here at CodeGrrl.
April 12, 2004 |
By Sasha |
Comments Off |
Filed under Scripts, Updates
-
-
15/10
Skybly wrote a tutorial on how to display the members you added on your last update (in PHPfanbase) on the forums, and I’ve posted it on the site. This is similar to the “Display most recent members joined” tutorials, but this one displays the right number of members per update – ie. if you last updated yesterday and added two members, it will show the two members’ names. Very cool.
October 15, 2003 |
By Sasha |
Comments Off |
Filed under Tutorials, Updates
