 Avoid Phpbb! New Security Exploit! |
|
|
|
|
  |
 Sep 22 2006, 03:15 AM
Post
#1
|
|
|
NiGHTFoX - Hiding in the dark  Group: Members Posts: 680 Joined: 3-April 05 Member No.: 3,584  |
I sure have learned my lesson of using phpBB on a site of mine that gets many hits. Apparently, the attacker used a SQL injection (my password is 7 characters and is VERY hard to crack) to gain admin access and deleted everything then left his mark.
I don't even know WHY phpBB is allowed to exist and WHY it's so popular... I'm NEVER going to use it again! Keep away from it! [N]F |
 |
 
|
|
Sep 22 2006, 12:04 PM
Post
#2
|
|
|
Nenad Bozidarevic  Group: [MODERATOR] Posts: 1,013 Joined: 7-November 05 From: Belgrade, Serbia Member No.: 9,500 |
 Nothing new on the horizon, unfortunatelly. It is well-known that phpBB is the BBS with most security issues. And with hundreds of cracking tutorials on-line, even a kid could get into phpBB. On the other hand, it would be hard, even for a pro, to crack SMF. In my opinion, it is the best free BBS when it comes to security. It might not be as good-looking and customizable (the number of mods) as phpBB, but it sure is more secure.
|
|
|
|
|
Sep 23 2006, 11:09 AM
Post
#3
|
|
|
Advanced Member Group: Members Posts: 127 Joined: 31-August 06 Member No.: 15,636 |
I don't fully understand.
Anyway if you're talking about a phpBB forum, there's no point you should use proboards. |
|
|
|
|
Sep 23 2006, 02:03 PM
Post
#4
|
|
|
Newbie [ Level 1 ] Group: Members Posts: 6 Joined: 29-August 06 Member No.: 15,591 |
Isn't there any way to prevent these SQL injection attacks ?
BTW, what is an SQL injection attack ? I'm using phpBB for my site and I loved the customizability. SMF seemed a little harder to use ( for me at least ) Isn't there any way we can make phpBB safer ??? |
|
|
|
|
Sep 23 2006, 04:07 PM
Post
#5
|
|
|
Advanced Member Group: Members Posts: 190 Joined: 18-August 06 From: Fun.NiranVv.Com Member No.: 15,325 |
Hope, the phpBB team will come up with a solution to avoid these SQL injection attacks!
I'm also using phpbb for my forum! like it very much as it is the simplest forum and easy to maintain than any other bullettin boards! I like the simple interface also!  QUOTE(FunDa @ Sep 23 2006, 07:33 PM)  BTW, what is an SQL injection attack ? QUOTE SQL injection is a security vulnerability that occurs in the database layer of an application. The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and thereby unexpectedly executed. SQL injection is a technique used to take advantage of non-validated input vulnerabilities to pass SQL commands through a Web application for execution by a backend database. Attackers take advantage of the fact that programmers often chain together SQL commands with user-provided parameters, and can therefore embed SQL commands inside these parameters. The result is that the attacker can execute arbitrary SQL queries and/or commands on the backend database server through the Web application. You can see more about that here, here and also here How to avoid SQL Injection >> Read it here & here This post has been edited by pyost: Sep 23 2006, 09:25 PM |
|
|
|
|
Sep 23 2006, 04:26 PM
Post
#6
|
|
|
Member [ Level 1 ] Group: Members Posts: 48 Joined: 30-April 06 From: Salisbury Member No.: 13,107 |
This is very alarming.
I've been deciding which setup to go to and this must be the third instance I've heard about phpBB getting SQL injhected (if that's a term being used now). So I guess I'm left with SMF then. Is there any other free forum out there that's noteworthy that anyone here can recommend? |
|
|
|
|
Sep 24 2006, 06:10 AM
Post
#7
|
|
|
Advanced Member Group: Members Posts: 187 Joined: 15-November 05 From: Inland from the Left Coast of Canada Member No.: 9,627 |
Try phorum.org.
It is used as a forum by Larry Ullman, an author of php and mysql books, so I suspect that it is rather secure. Also, this was posted on the phorum site Main page, which leads me to think it just might be secure: QUOTE * There is no shortage of message boards that use MySQL. When the webmasters at mysql.com went looking for one to install, they chose Phorum. |
|
|
|
|
Sep 24 2006, 08:11 AM
Post
#8
|
|
|
The Modernator Group: Members Posts: 486 Joined: 6-August 06 From: The Interweb! Member No.: 15,021 |
Bad luck Nightfox...I feel for you..must have been terrible to login and find your board contents gone ;((
Did you have a backup in anyway? |
|
|
|
|
Sep 24 2006, 10:11 AM
Post
#9
|
|
|
the Q  Group: [HOSTED] Posts: 1,051 Joined: 13-July 05 From: Lithuania, Vilnius Member No.: 7,059 |
Because phpbb is so popular for a long time now, a lot of whom know the source code and know how it works, so if you know how it works, you can always mess it up, don't you? Eventually, I read that SMF is much more secure to exploits and sql injections, because it is coded differently than phpbb, but people who is used to use phpbb - they have difficulties of moving to other forums such as SMF or don't have enough income to buy IPB or vBulletin.. They defend phpbb and say that those sites which get successful attacks didn't configure it the way it needs to be configured + the server configuration is bad and etc. It would be best to create your own forum system, but it just takes time and why waste the time if somebody else wrote it?
 There are more forum software written but not so popular, so they might be more secure, but with less features and modifications + skins. I myself wanted to use phpbb, but as it is so vulnerable to exploits, I never did it, but I think I will use Phorum, which is available for a long time, but new versions are available now and I hope it will suit my needs.. I just need a very customizable forum software written in php which would work with mysql database. |
|
|
|
|
Jan 28 2007, 05:03 AM
Post
#10
|
|
|
Newbie [ Level 1 ] Group: Members Posts: 7 Joined: 27-January 07 Member No.: 19,972 |
oh ****! I ever used phpBB ... * gulp* well ... then i'll use phpbb 3 ; it's much more secure!
 BTW i don't like smf , don't have money for IPB or VB... :/ |
|
|
|
|
Similar Topics
|
Lo-Fi Version | Time is now: 11th October 2008 - 11:27 AM |