Website exploitation

[Eternal]

As from what some of you have found out anyone can take over your game in a matter of seconds no matter how you escape sql strings and protect it.

I won't disclose the exact format on this but i will say alterting http headers to change X_Forwarded_for to "0.0.0.0',string='input of database feild" will just alter anything in the table your using to monitor ip's

Changing X_Forwarded_for to getenv("REMOTE_ADDR") Will display the users correct ip rather than letting someone altering it.

 

 

 

I know this isn't a mod but it is an alter of the mccode scripting so i would suggest doing the change before someone targets you next. Just altering tables isn't the only thing you can do.. So beware

[Guest Anonymous]

Re: Website exploitation

This security threat was posted the other day (and the easy solution to fix it), even though it was already well known.

http://criminalexistence.com/ceforums/i ... ic=28463.0

[Eternal]

Re: Website exploitation

lol yer didn't see that lol.

I been using this for a while now i could just tell everyone the way to activate it so all the games on the net get taken down :P

[bigm]

removed

i have removed this as i posted wrong

[bigm]

Re: Website exploitation

Still would be a +1 (if used) for posting fix just incase :)

[noddy]

Re: Website exploitation

+1 FOR YOU MY FRIEND

[supernova800]

Re: Website exploitation

Yip, +1 from me too, thanks :mrgreen: