xss injection question

Anyone else seen this thread?

Iframe MYSQL Injection (http://centiyo.com/in.cgi?default)

Looks like we had it happen on one of our sites today... and we are running 3.8.4pl1 on that site as well with the latest vbseo so upgrading is not an option.

Anyone else?

VBSEO? I just opened a ticket.

Hello ,

I responded to your ticket

What about anyone else out there?

Hello Dascrow,

There is no evidence that this is a hole with vBSEO, therefore, I'll update the title of this thread as to not create anxiety among community members.

If we determine it's something related to vBSEO, we'll definitely make sure everyone gets notified.

Thank-you

To repost what I put in that thread; (hope this is ok with the vbseo guys)

3.3.2 was a patchreleased on November the 18th to fix a security loophole. Why you haven't updated yet is beyond me.

I literally applied it within minutes of getting the email.

Sounds like your own fault for not keeping on top of things.

Originally Posted by Dunhamzzz

To repost what I put in that thread; (hope this is ok with the vbseo guys)

Thank-you Matthew, however I've based my post on the information gathered via the support ticket Dascrow has opened. I simply changed the post title as there is no evidence that his site exploit was caused by a hole in vBSEO.

Originally Posted by Dunhamzzz

To repost what I put in that thread; (hope this is ok with the vbseo guys)

And also, as mentioned in that other thread, this is a new site and as such had 3.3.2 on it from day 1. So your post is obviously invalid in my case.

So, either they got in via another method or vbseo is still vulnerable. It is impossible for me to tell what method was used at this time.