viewjoinrequests bug?

[Halo2Forum.com]

a friend of mine said that he has a weird problem on his forum. a user account keep changing to admin account. he said this hacker some how becomes admin over and over again after he bans his account, etc.

i decided to take a look at the control panel log. and i noticed a trend. every time this account turns into admin, the first thing i see him doing is this:

1339 Am.Two.X.two 02:32, 13th Nov 2008 user.php viewjoinrequests 114.58.71.XXX

I've seen him become an admin 3 times after I remove him from admin and that's the first thing he executes.

[Jake Bunce]

Check for public joinable groups with admin access:

Admin CP -> Usergroups -> Usergroup Manager -> Edit Usergroup -> Public (Joinable) Custom Usergroups

Admin CP -> Usergroups -> Usergroup Manager -> Edit Usergroup -> Can Access Control Panel (is Administrator)

[Halo2Forum.com]

only 'banned' is the custom one and admin access is set to no

here's the screenshot of the usergroup manager



also, i found something strange. in the usergroup manager, i see 3 admins. but when i check 'administrators permission' in usergroup, i only see the two admins, he's not listed in admin permissions.

[Halo2Forum.com]

any help?

[Jake Bunce]

also, i found something strange. in the usergroup manager, i see 3 admins. but when i check 'administrators permission' in usergroup, i only see the two admins, he's not listed in admin permissions.

That is odd. Check the profile of the third admin. Remove him from the admin group if he's not supposed to be there.