New user made himself an admin

[deadandy]

A new user account appeared in my database and somehow made himself an admin through the control panel. I'm assuming he used some exploit but I can't figure out what or how. The only clue I have is a handful of actions that appear in the Control Panel Log (image attached). Is there any way of telling what he did or what plugin he exploited? I deleted the user account, BTW, which is why it appears as N/A.

[In Omnibus]

Did you delete the "install" folder from your server? If not, that's likely your answer.

[Teascu Dorin]

Did you delete the "install" folder from your server? If not, that's likely your answer.

Also if he did created an admin account you most surely have some hackers plugins installed.

[Zachery]

First you need to follow our advisory about deleting the install folder off your forums.
Then please read the following two blog posts:

http://www.vbulletin.com/forum/blogs/zachery/3993888-fixing-your-site-after-you-have-been-hacked

http://www.vbulletin.com/forum/blogs/zachery/3993849-best-practices-for-securing-your-vbulletin-site

Also please see these recent security announcements:
vBulletin 4.1.x-4.2.x & All versions of vBulletin 5: http://www.vbulletin.com/forum/forum...-1-vbulletin-5
vBulletin 5.0.x patch released, for a different security issue: http://www.vbulletin.com/forum/forum...d-all-versions

[Nauti Rogue]

Ironically, I have just noticed 3 users who have done the same on my forum within the last week or two. The issue was the fact that I had failed to delete the install folder. I've corrected this now, and I've deleted the other Admin accounts, but is it too late? Have I shut the barn door after the cows got out? What could they have done? What should I look for?

[DemOnstar]

Check your plug ins for something you didn't install and remove it..

[Nauti Rogue]

Thanks. I uninstalled Skimlinks and Postrelease. I now notice that I'm getting the following warning: "Warning: Plugins are currently globally disabled via config.php." in the Plugins page. Is this normal, or should I go check that out? It seems like that's a good thing, except that I had previously had Forum Runner working correctly for the forum. I assume for Forum Runner to be working correctly in the past, I plugins must not have been globally disabled. Why would a hacker install plugins and then disable plugins?

[Mark.B]

No real need to remove Skimlinks and Forum Runner...your rogue plugins are probably under the "vBulletin" product.

The message you are receiving is because plugins are ALL disabled, which is normal.

In this instance I would suggest raising a support ticket so we can get your login credentials and take a quick look around.

http://www.vbulletin.com/go/techsupport

Please include AdminCP login and FTP credentials in the "Sensitive Data" field.