hack attempt??

[sanddancer]

Hi for some reason we have someone loggin is as charles and deleting other peoples posts, it shows up in the admin panel? ive searched on the ip on google and it comes up as open proxy

any ideas?

Thanks

[Chuck S]

Only way someone can get into your admin panel or delete posts is if you give them mod or admin access to your classifieds or if this is a forum integration in your forum

[sanddancer]

hi chuck

they have no admin rights and do not exist as a user, it is a forum intergration however!

what would you reccommend?

Thanks

[Chuck S]

well if they are getting into your forum admin and deleting posts have you posted this on your forum support? Sounds to me like your talking more about your forum instead of anything in classifieds

[sanddancer]

so do you think its the forum software allowing them to log in and delete peoples classfieds ads on the classifieds software? Thanks

[Michael P]

Major Security Flaw!!!

Take a look at this thread; this might explain it.

[Chuck S]

If they are not getting into admin but instead editing other people's ads as Michael posted you can download the beta and use that which has the fix applied.

[sanddancer]

hi yes thats correct does photopost have a fix available yet cant seem to find it?

thanks very much

[Michael P]

Try the link one above in post #6.

[sanddancer]

hi michael but isnt that for reviewpost and not the classifieds software?? or am i overlooking something

[Chuck S]

That edit was also added in classifieds as it is the same it was an issue with all the software. The $echeck was added in 5.6 Photopost and we have added that to the other products as well. If your using Classifieds 2.6 just redownload the package and upload editproduct.php