SQL Bug

[mxtabs]

Yes, sorry, member2 is just a copy of member

http://www.musicianforums.com/forums...r.php?u=201148

[mxtabs]

Thanks!

[mxtabs]

3.6.1

<!--
Database error in vBulletin 3.6.1:

Invalid SQL:

SELECT
userfield.*, usertextfield.*, user.*, UNIX_TIMESTAMP(passworddate) AS passworddate,...

[mxtabs]

I don't want this timeout to last a year or whatever it is set to currently. Where can I access this setting, to change it to say, 3 days?

[mxtabs]

Never mind, fixed!

[mxtabs]

Edit: Nevermind, all solved now. I modified the algorithm slightly...

[mxtabs]

Yes, but I don't think that eliminates some of the cookies they've stolen

[mxtabs]

I've tried changing the cookie prefix, even adding something to the md5 salt, but it seems as if vb is not reauthenticating the cookies on each page. Shouldn't there be a password/session/cookie check...

[mxtabs]

Evil users have stolen the session ids, via XSS, of members. They can now log into these accounts any time they choose. Is there any way to invalidate all sessionids and force universal relogin?

[mxtabs]

Here is an example post:

News, stories and the latest infos on

www.party-fever.info.com


A link:

http://rload.dajoob.com/rpp.php?c=bblastvi...

[mxtabs]

We delete all of the links but I will try to find an example for you.

The problem is that we can't stop the behavior - they are all 15 year olds that won't listen and return after repeated...

[mxtabs]

But it does - the hacking is real. Once again, is there any way to make the sessions more secure?

[mxtabs]

What about the URL tag in Posts, then?

Nice

What I'm saying is that this kind of thing is inevitable, is there any way to make the session more secure?

[mxtabs]

That's a good point. But how else can I stop this? They are using external XSS - and disguising every link. Even if the mod staff is careful, it's going to happen.

Perhaps if someone logs...

[mxtabs]

Script kiddies at my forum use a trick where they get members to click on external links. At these external sites, they use XSS to steal the forum cookies. They then log in as those users on the forums,...

[mxtabs]

That's exactly what I mean, thanks!

[mxtabs]

A rather sizeable contingent of users on my board like to do something like this:

They make a link that appears on the page as a URL, usually in answer to some question. (IE, the page displays...

[mxtabs]

ok, thanks for listening. I'll check at vb.org

[mxtabs]

2 seperate companies? I don't understand why you won't at least look for a potential javascript conflict... it's not like I'm the only vbulletin user trying to display ads.

I'm not asking...

[mxtabs]

This is not custom code. This is code from two of the largest ad networks in the US. It works completely on all non vb pages, but not within vbulletin pages. I believe this is covered in vbulletin support......