[Dave Skylark]

Does it have anything to do with the index2.php on here we were redirected if clicked the logo?

[T3h Hack3r]

Does it have anything to do with the index2.php on here we were redirected if clicked the logo?

No that's seperate. Index2 is used when the site is under attack.

[MrOrang]

Thanks for letting me know about this, I'll keep an extra eye out for malicious links.

[SwimmingPool]

I thought the MyBB CSRF vulns were all fixed upon the implentation of postkeys?

Read the thread again. There isn't any exploit. Omni is stating that false rumors of one might start.

[Simply™]

I love how so many people are saying "Thanks Omniscient" or "Thank you Omniscient" and that's all they put. Not sure if they are kissing ass or just using it for characters.

ot: Would this affect others forum sites using MyBB?

[Ilikeponies69]

Omni, thanks for ruining my new years eve gift. Fine, just be like that :(

Lol jk, but seriously Omni, you had to be mean and post about it, ay?

Since people will ask me how omni found out about it, and/or ask proof its me who is going to release it, might as well:

You can see a full disclosure here with project ideas if you want to make it a nice product since it can be used as a helpful API if you want: https://hackforums.net/showthread.php?tid=4609063

---

I love how so many people are saying "Thanks Omniscient" or "Thank you Omniscient" and that's all they put. Not sure if they are kissing ass or just using it for characters.

ot: Would this affect others forum sites using MyBB?

Yeah, it's just a CSRF bypass pretty much if you can swipe the "keys to the castle"

[Omniscient]

Since people will ask me how omni found out about it

Let's clarify a few a things. Your bug report is nonsense. Already had a lengthy discussion with you about it. I even gave you the tester account post key but you were unable to do anything about it.

In hacking and pen testing there is such a thing as "proof of concept". All you have is concept. Not an original one either. Something that was addresses and fixed by MyBB years ago.

Yeah, it's just a CSRF bypass pretty much if you can swipe the "keys to the castle"

It's ridiculous statements like that which piss me off. You make it seem like having the post key opens up the doors. It doesn't. I gave you a tester account postkey and you could not perform one function with it.

You think you helped when in-fact you wasted hours of my time and then you say you're going to release this in 2 days which to the untrained eye will appear a legitimate bug which it's not. You'll spread rumors and create more problems than is warranted.

I'm not going to let you freak out tens of thousands of members because you're excited that you think you found something.

For example you made this post on another thread:

It used to be the code for a MyBB CSRF bug

There is no bug. You're making up a rumor. You have nothing. You can do nothing. Your concept is trash.

Lastly...you're gone.

[He B TeMy]

Can i ask what version of MyBB does hackforums.net use?
Not relevant to the thread but, i have a thing for updates.

[Omniscient]

Can i ask what version of MyBB does hackforums.net use?
Not relevant to the thread but, i have a thing for updates.

The HF version at this point isn't really truly a MyBB version release because it's patched a lot with core file edits and my own security changes.

[$lick]

3. Don't use the same password on HF anywhere else. This is seriously important.

I have no idea what my HF password is, the site generated it for me.

[zombieman]

Can someone elaborate on this bug more? I get that it's a CSRF, but what are the specifics? I would like to see if this is present in 1.8 as well.

Also, one of the forums I frequent had its ACP compromised and shelled 2 days ago. Would that be possible/feasible through an exploitation of this CSRF bug?

[Omniscient]

User said he was doing full disclosure on New Years Day. That's up to him to publish his findings. It's well-written but at the end of the day it's pointless.

[well then]

User said he was doing full disclosure on New Years Day. That's up to him to publish his findings. It's well-written but at the end of the day it's pointless.

'Full disclosure,' and could barely back up his claims and findings.

[zombieman]

User said he was doing full disclosure on New Years Day. That's up to him to publish his findings. It's well-written but at the end of the day it's pointless.

I've also gotten word that there's a second 0-day going (SQLi?) around on a couple underground forums, and two pretty large forums had their ACP's breached and one got shelled as a result. Are you aware of anything like this, or is it just speculation?

[T3h Hack3r]

I saw the OP's thread prior to it being removed. It was well written I must admit. It's unfortunate he had to be an asshole about it and have his account closed.