This bulletin affects all versions of PhotoPost vBGallery released to date.
We recently became aware of a new exploit that hackers have created in order to upload and attempt to execute php scripts on a webserver using vBGallery. The exact details of the exploit were emailed to PhotoPost customers and are available to valid license holders upon request.
Ultimately, this is a security flaw in the Apache webserver and has the potential to affect any software that handles user file uploads, not just vBGallery, but you should know that PhotoPost Pro is not affected by this particular issue.
We now have modified vBGallery in an effort to help you minimize the ability of hackers to upload these scripts. You can
download this latest version of vBGallery 2.4.2 (for vBulletin versions 3.6.8 and 3.7.0 beta 3) and update your site accordingly. Update instructions can be found in our
2.4.2 announcement.
If you're running an
older version of vBGallery, we also have instructions on how to manually patch the necessary files. Note that these manual instructions apply to vBGallery versions running with vBulletin 3.5.x, 3.6.x, and 3.7 only.
We are also providing a script called clean.php, attached to this post as clean.zip, that scans your vBGallery upload directories and helps remove any malicious files pertaining to this particular exploit that any would-be hacker may have uploaded. Instructions for using clean.php can be found in the included readme.txt file. You can upload the scanner script to your server and run it one time to remove any such files from your upload directories.
As an added security measure, you also can configure your Apache webserver to disallow the execution of any scripts (PHP, Perl, or otherwise) from your vBGallery upload directories if you have the expertise to do so. This is an added security measure that security conscious sites can take regardless of this new exploit, since it gives you additional protection to address potential as-yet-unknown exploits involving file uploads.
As always, we recommend that you backup your database and files on your webserver(s) now and before you run any updates, the cleaning script, or apply any other patches.
If you need our assistance to update your gallery to this newest 2.4.2 version, or to run the clean.php script, you can
purchase the upgrade service and we will perform these tasks for you.
Please
contact us should you have any questions.
Linear Mode
