Banned user posting, can it only be permissions?

[JamesUK]

hi,
we have a banned user who has posted on our forum since being banned. I've searched here and read that the most likely cause is permissions, but I've checked those with another test account where I have duplicated all the user's settings. All I see is the 'go away you are banned' message.

Before I tear through my permissions with a fine toothed comb, is there anything else I should be aware of? we're running V3.5.4, are there any known exploits that would mean a user can insert a post into a forum without using the usual interface for example?

thanks,
a very baffled James

[Steve Machol]

Yes, there are known exploits in 3.5.4. Also if you have any add-ons installed, these could affect permissions as well.

I strongly suggest the you upgrade to at least 3.5.8 immediately. Also please see this thread on how to make your vBulletin more secure:

http://www.vbulletin.com/forum/showthread.php?t=172234

[JamesUK]

thanks for the prompt answer Steve.
I'm lucky in that we have verbose logging turned on, but unlucky enough that due to that I can see that the user has viewed sections of the forum only designated to admins and which also contain secure information

I'll upgrade to the latest release straight away.

[JamesUK]

v3.6.8 now installed and working
I'll have a go through the security thread and get all that done too
thanks again for the speedy reply