03/12/14 at 11:37am
This Codex is Read Only, there is No reason or requirement to Login to view any and all posts.
YaBB Support Codex
Past YaBB Forum Software
› [Y2.1] YaBB Security Patch 06/12/07
[Y2.1] YaBB Security Patch 06/12/07 (Read 2950 times)
[Y2.1] YaBB Security Patch 06/12/07
A vulnerability has been found in YaBB 2.1 that allows members to enter specific text into some profile form fields to gain administrator access to the forum. Administrator rights, grants the member access to the forum controls.
This fix is not included in the YaBB 2.1 (Now available as YaBB 2.1.1) download at this time. It must be applied to all new forum installations.
After installing the attached mod to your forum, users will not be able to use this vulnerability any more. It converts these form fields to their HTML equivalent and removes line breaks, rather than writing them directly to the profile data (.vars) file.
To install the mod, please use the BoardMod program at
, to apply the code changes automatically to the YaBB 2.1 source files. Then upload the updated source files to your website on top of the original files. You may also apply the code changes manually to your code if you wish to preserve existing mods. The mod file can be opened in a text editor such as Notepad.
The attached zip files has the MOD already installed, Just Download and UnZip the file to your personal computer, Then Upload the files to the appropriate folders, over writing the existing files.
This patch was included in the code for Y2.2 and still is for newer versions.
(22 KB |
Top of this page
Forum Jump »
» 10 most recent Posts
» 10 most recent Topics
Frequently Asked Questions FAQ's
YaBB 3 Development
Upgrading to YaBB 2.X
Setting up YaBB Forum
Understanding the Admin Center
Managing Your Forum
Languages Addition and Translating
Guardian, Spam & Censor Settings
Backing up and Restoring
User Requested Template Modifications
Past YaBB Forum Software ««
YaBB 1.x (No longer Supported)
Installation, Setup, Errors and Structure
YaBB Support Codex
» Powered by
YaBB Next Edition
YaBB Forum Software
© 2000-2011. All Rights Reserved.