Forum Hacked?

[Ahab_Flanders]

I keep getting this box popping up whenever I load the forum.

It only happens on this site. I'm not sure what would happen if I entered my password, but getting "Pwned by Team C0rrupt!" doesn't sound fun.

 

[Ahab_Flanders]

I think it's coming from this post in the shoutbox:

1. 39 minutes ago - TheJoker1337

Which is an image link which leads to: http://corruptsecurity[dot]net/tools/xxe.png

 

[BxLio91]

You clicked it?

 

[Ahab_Flanders]

You clicked it?

Right click>Copy image location

 

[CP_Scouse]

i got to this weird website with a cartoon goat. how does one screenshot?

 

[CP_Scouse]

UPDATE; the picture leads to a forum dedicated to hacking and hackers. i woouldnt fuck with them

 

[Ahab_Flanders]

You clicked it?

Scouse clicked it. He does the durrty work.

Edit: to screenshot press the print screen button on your keyboard and paste it into Paint or something similar.

 

[CP_Scouse]

http://corruptsecurity.net

click cancel when asked to enter username and passowrd
stay idle for 30 seconds then press enter forum

 

[CP_Scouse]

 

[BxLio91]

It's green. Must have been a f.cosmos fan.

 

[Falastur]

I've deleted the message from the chatbox.

 

[Ahab_Flanders]

Thanks Falastur.

 

[NYCFC_Dan]

We'll deactivate the shout box for a while. It's gonna happen. i kinda figured going into this there will come a time when a hacker tries to do something but the security here is good and unless you actually enter your info in there there's nothing they can do.
I got a buddy whose dad does server security for corporations and he does some stuff too. I'll hit them up and see if they can do something for us.

 

[413Blue]

Cool. I don't think it's a problem unless a user on here happened to use his/her username and password thinking it was just some glitch.
If you did, you should change your password on here ASAP, and also make sure if you use the same password for other sites, especially your email, change them. The person who did this could use your password to gain access to your email address, which I am assuming could potentially be found through this site. Once they get into your email, they can have a field day getting into bank account and facebook etc.

 

[NYCFC_Dan]

Cool. I don't think it's a problem unless a user on here happened to use his/her username and password thinking it was just some glitch.
If you did, you should change your password on here ASAP, and also make sure if you use the same password for other sites, especially your email, change them. The person who did this could use your password to gain access to your email address, which I am assuming could potentially be found through this site. Once they get into your email, they can have a field day getting into bank account and facebook etc.

Only admins can see email addresses so that shouldn't be a problem. That person has been banned on multiple levels and we disabled shout box until that exploit is fixed. They can post that code here on the forums but the shout box was an add on and didn't protect against it.