My forum was hacked yesterday. Need help.

[amfor]

I have Vbulletin 3.8.8 board installed on my server, now I upgraded it to the last verstion 3.8.9 Patch Level 1 and seems have a seriously problem with security on my forum.

Two days ago I found that hackers used a some backdoor in the Vbulletin 3.8.8 and uploaded to the /tmp directory of my forum the PHP exploit b374k. After it they got access to the SQL database, downloaded a whole SQL table and removed the attachment directory from the forum. I have a backup and restored the forum fast enough.

I have a question. Are developers know something about backdoor in Vbulletin 3.8.8 which allow to upload php files to the /tmp directory of the forum?
How to fix this problem?

Thanks.

[Wayne Luke]

There is no known backdoor in 3.8.8 if it is installed correctly. The installation directory should be deleted after upgrades and you should use .htaccess to prevent access to your AdminCP.

Your /tmp directory would ideally be outside your /public_html directory and not writable from the web at all.

However, if you use third-party Addon Products, these can be out of date and provide access. Plus there are exploits in previous versions and if these weren't properly closed, then they could have already had access. While written for vBulletin 4, the steps in the Securing Your Site topic linked below are applicable here:

https://www.vbulletin.com/forum/foru...ring-your-site