Mysteriously Added Usernames
 

Here's the situation - there's a member, legitimate member, has signed up through CCBILL, he's been cancelled twice for being a pain in the ass - he logs in from 3 or 4 different IP addresses - the mystery is that he seems to have the ability to create new username/passwords to login once he's been cancelled - these new usernames don't show up in CCBILL's admin(not a cancelled member, not a manually added signup, not an active member,nothing) or Paycom's as a member. Anybody know what this guy could be doing to add new usernames for himself? This are now two usernames he has that CCBILL and Paycom don't show.

thanks

Get Strongbox

Could be SQL code injection.

http://www.sitepoint.com/article/sql...n-attacks-safe

I would just blame Jesus

Good article Matt, thanks! :thumbsup

ADG Webmaster

I have the same problem (even with Pennywize protecting my sites), people are able to hack my .htaccess and create their own accounts! I'm not sure how they do it either...

Simple...He has determined the name of the ccbill script on your server.
You most likely have the same name that the script comes with.

Solution: Change the name of the ccbill password script on your server to something like this:

ccbil39845wjHIiekjnsjj595j~smIMkmkbd.cgi

That should shut him down forever.

Yep, that solved it for me!

strongbox is excellent, ray is good people :)

Looking forward to learning more about the new NATS security solution.

Make sure you are using the most recent ccbill and paycom scripts. The old ones have exploits.

That has always been the case. How recent is the most recent script?

talking about advanced porn surfer!

I dont know, you'd have to call ccbill or paycom to find that out. When I say it is important to use the most recent script, I dont mean from month to month. I mean every couple of years, if one is experiencing problems with their script, they should call their billing company to make sure they are running the most recent version of their script.

Some thick heads in this post.

Exploits in the ccbill script? So fucking what? They can't exploit a script that they can't find because you changed the name.....DAMNNNNNN!!!!!!