Thread: help a script is sending my user passwords to an email

found and solved , here is what i found on some plugins ! just a mod but tell me plz if this this are the plugins added ! member_complete vb-sec2 login_verify_success vb-sec3 global_setup_complete vb-sec4 misc_start and this is the content of the vb-sec2 $message = "username: " . $vbulletin->db->escape_string(htmlspecialchars_uni($username)) . "Password:"....

what were the mods. The fact you removed them means nothing if thats how they got in.

@tnc, that is true, but that is changable.

The above script can only sent out real passwords if your config.php file is set to sent plain text passwords to the server. On a default installation plain text passwords are hashed on the client side and never even sent to the server. It is strongly recommended, the proof is in this thread, not to allow unhashed passwords to be sent to the server.

This happened on a vB board I'm a member of a few weeks ago. The server was compromised and a harvesting script that prompted usernames and passwords to be entered was planted on the homepage. These were logged to a txt file and later published online with everyones usernames and passwords. The amount of times a member tried to login was how many times they appeared on the list in the txt file. This is the reason why your...

Disable your products and contact vB support.

Originally Posted by msimen found and solved , here is what i found on some plugins ! just a mod but tell me plz if this this are the plugins added ! We'd still like to know which mod did this. Please check in Plugin Manager... above those files listed above, there should be a Product: name. Write down the product name, then go into Manage Products and find that product on the list. If the product's name is underlined , then...

The above script can only sent out real passwords if your config.php file is set to sent plain text passwords to the server. On a default installation plain text passwords are hashed on the client side and never even sent to the server. It is strongly recommended, the proof is in this thread, not to allow unhashed passwords to be sent to the server.