staff accounts keep getting hacked??

[chrisissick]

every day some one on my staff team gets hacked by some one? how are they hacking the account without changing the pws or getting to the db? sickhotel.net is my hotel someone give me some advice to prevent this?

 

[Wickd]

You have RevCMS exploits,patch them up.

 

[chrisissick]

You have RevCMS exploits,patch them up.

could you point them out or help me patch them i could pay you?

 

[Jerry]

There is a new RevCMS exploit that released out there called the forgot php script look on the Habbo Releases section, you'll see 'Important RevCMS Exploit Fix!'.

 

[chrisissick]

There is a new RevCMS exploit that released out there called the forgot php script look on the Habbo Releases section, you'll see 'Important RevCMS Exploit Fix!'.

i followed your tut. how do i know if i did it correctly? could you double check it any way?

 

[CoderX0X]

I would fix it for you hm u paying?

 

[CoderX0X]

Would only want 5-10 but i would fix ur exploits so yes or no?

 

[Jerry]

Go to class.users.php
find

final public function forgotten()

Replace the whole code with that with this;

final public function forgotten()
    {
        global $template, $_CONFIG, $core;
       
        if(isset($_POST['forgot']))
        {       
            die("Stop trying to \'hack\' us you little skid, we already patch this..");
        }
    }

 

[GarettM]

Go to class.users.php
find

final public function forgotten()

Replace the whole code with that with this;

final public function forgotten()
    {
        global $template, $_CONFIG, $core;
      
        if(isset($_POST['forgot']))
        {      
            die("Stop trying to \'hack\' us you little skid, we already patch this..");
        }
    }

I think I'd be wise to just delete the function from the class.user.PHP and remove the function call from the class.core.php

 

[GarettM]

I think I'd be wise to just delete the function from the class.user.PHP and remove the function call from the class.core.php

By the way the forgotten function should be fixed not just deleted :/ your deleting parts of revcms that should help users

 

[calmabro]

By the way the forgotten function should be fixed not just deleted :/ your deleting parts of revcms that should help users

The CMS also won't work by just removing it u will get white screen, so it won't work like that.
I've just deleted the function from class.core.php and it seems to be fixed.

 

[Khalil]

The CMS also won't work by just removing it u will get white screen, so it won't work like that.
I've just deleted the function from class.core.php and it seems to be fixed.

You'll get a white screen or an error message because the function is still being called in 'interface.users.php', so remove the function from class.users.php then go to interface.users.php and remove it from there too, problem solved.

Please, do note that rev uses interfaces, so whenever you remove a function from a class, make sure to go to that class's interface and remove it from there too.