[KerryG]

All the functions work but the remote shell exploit is still there, this is the most dangerous of all of the exploits. I am happy to help test solutions to it and post the results but right now the site is wide open.

If you run this script against a "patched" system, you gain shell access

[Yankidank]

We have a beta version ready to go out in the next half hour. Watch the downloads section. Hopefully it will fix all issues and not add any more.
I also have hired a third-party developer to go through the code and find any missed security vulnerabilities and patch them. His findings will be reported to me in 2 more days and I will follow up with another patch if necissary. Tonight we will be getting out an emergency version to hopefully combat these new issues. Please let us know if the new version seems to work for you. It will be posted in the Current Version forum in no time.

[KerryG]

Make sure you rename your htaccess.default files to .htaccess, this will help tighten up the security as well.

[Yankidank]

New Version Out
Pligg Beta 9.9.5

[catchpen]

Originally Posted by Yankidank

New Version Out
Pligg Beta 9.9.5

Thanks very much. But I was almost done with a highly modified version of .9.9.0.
So what files can I dissect from t his version to make my site more secure yet still 100% functional? Can i just use a file comparison tool or will i break my site?

[JAPUNDIT]

Glad to hear that the problem has been identified.

Glad to hear that Pligg people are working on it.

But.... What does one do after a site is hacked?

How do we "un-hack" the site?

[fgillig]

Originally Posted by Yankidank

New Version Out
Pligg Beta 9.9.5

Great.

I see this security hole just the day when I'm testing Pligg to use it on my (maybe one day "big") website

Administrators, can you rename/add this topic to [security fix done] or something else ? I think it can reassure new users that come here (like me)

Thanks,

[swese44]

My sites have way too much custom code to copy over a patch. Can we get a list of code changes that need to be made from 9.9 to 9.9.5?

[Yankidank]

Check the SVN for a changelog. The more recent changes are for security issues. There was one large change that covered a lot of files, that is probably the one.

http://www.pliggsvn.com

[onlinebisnes]

Thanks for the 0.9.9.5 update Yankidank,
but I am in the same situation as swese44. is there any guide on how to upgrade without replacing existing files?