New update - Potential security vulnerability addressed

[davidgwalker]

Hi Everyone,

I have released an update (yes the second in as many days), it contains changes to the functions.php file you MUST use.

Download the upgrade now:
http://www.dwalker.co.uk/phpautomembersarea/
Should take only a couple of minutes to apply

This release addresses a security vulnerability as highlighted
by Philipp Niedziela ( http://www.bb-pcsecurity.de ).

The fix is simple, just download the Upgrade above and add the new functions.php file to your server.

This update must be applied to ALL phpAutoMembersArea versions prior to 3.2.5.

When you have upgraded successfully you should be able to login to your admin area and see the new version displayed:
Functions.php: 3.2.5. The version for phpAMA maybe shown as an earlier version but this is not an issue, so long as Functions.php shows version 3.2.5

Ioncube help:
There is a new page for help on installing/setting up the ioncube loaders if anyone needs assistance:
http://www.dwalker.co.uk/phpautomembersarea/ioncube.php

Any issues please post here...

Thanks for reading and update as soon as possible

Dave.

Note - if you are an unregistered user and wish to post a possible bug then you can without logging in here:
http://dwalker.co.uk/forum/viewtopic.php?t=393

[marcus - streamcast.com.]

Dave,

Apologies if this is a stupid question.

To perform the update do we download phpAMA3.2.5.zip (209kB) version and replace the existing functions.php with new one?

Cheers

Marcus

[davidgwalker]

Hi Marcus,

If you look here you will find there are several links to upgrade zip files beneath the link to phpAMA3.2.5.zip link:
http://www.dwalker.co.uk/phpautomembersarea/

First you need to check which version you are using: login to your admin area and there you will find the version shown (bottom right).

If say you are currently on version 3.2.2, you need to download and install in sequence:

"from version 3.2.2 to 3.2.3"
"from version 3.2.3 to 3.2.4"
"from version 3.2.4 to 3.2.5"

This must be done NOW - else your site risks being compromised, if you do not have time to apply all the upgrades then you can just apply the newest one now:
"from version 3.2.4 to 3.2.5"
(this removes the potential security vulnerability, and can be applied in just a few minutes)

Hope that helps.

Dave.

ps. the questions that are not aksed are the stupid questions...!

[davidgwalker]

PLEASE NOTE:

Most often the code kiddies and hackers will find your phpAMA members area via google by doing a inurl search.

Read more here:
http://dwalker.co.uk/forum/viewtopic.php?t=520

[davidgwalker]

There are still many sites that have not upgraded!

I have even tried to send direct emails to inform many of this fact, yet they ignore me, such as:
https://kym.xlinternet.com.sg/system/members/join.php
[not a registered user, but I sent a notice directly as they are a heavy user that hack my script...]

Please upgrade now or you risk being hacked.

Dave.

[support - traders-guild.]

Thanks for the notification of the update Dave, always reassuring to know that it's being kept on top of

Will have mine updated when I'm back from the kids break in a couple of days.

Cheers.

[lfhost]

Got mine all updated without issues.

Cheers for updating promptly.

[support - traders-guild.]

Yep, mine now updated without any issues.

Thanks again Dave.