A very serious security issue in version 6.0

dddd posted 4th of June 2008 in Community Voice. 6 comments.

There is a very serious security issue in version 6.0 of dolphin.

I am not sure if it's changed in recent versions, but requires immediate action.

I have started a blog on Dolphin issues and posting it there.

Please have a look

My blog on Dolphin issues

Comments

Newest

·Oldest

·Top

Please login to post a comment.

AndreyP•4th of June 2008

Hello, we haven`t such embedded code, I recheck all revesions since 6.0, and we haven`t any same code

seems only you have same code

Regards

Permalink•Reply•Plus•0 pluses

SergeyZ•5th of June 2008

Hello!

Do not worry about this code. It was only in beta versions just for testing issues. It was removed in final release. Please upgrade your copy of Dolphin to the newer, more stable version. I recommend 6.1.1. ;)

Best Regards.

Sergey Z., Official Dolphin Developer.

Permalink•Reply•Plus•0 pluses

tango3d•5th of June 2008

I have saved all previous downloads of the dolphin script I have scanned all of them and found the same code here: Dolphin-v.6.0.0003-AdFree.zip

Permalink•Reply•Plus•0 pluses

mscott•5th of June 2008

Let me translate what SergeyZ is saying... if you are using the older versions you DO have a backdoor!? I checked and it IS there!?

Permalink•Reply•Plus•0 pluses

gameutopia•6th of June 2008

This is interesting, because I didn't know that my 6.03 version was a beta release version. And yes the code is difinately in 6.03.

I sure hope someone doesn't later post some decoded code that does something similar in 6.1x. I have noticed a number of encoded characters in 6.1x that I am not really sure what it does. I would be a little disappointed if any of it turned out to be something similar.

I am not ready to upgrade to 6.1.1 for a live site. I'd take the 6.03 I've been playing with see more

Permalink•Reply•Plus•0 pluses

dddd•7th of June 2008•to gameutopia

I think Boonex guys should honestly admit this. This code is obviously reading a file with admin login and pwd from their Boonex site and inserting it into your admin table. As you all know, an admin can do whatever he wants.

I think their solution was not that smart, because they left one line sql visible which inserts into admin table. Actually it is possible to do it in much smarter ways which are much more difficult to detect and claim.

I don't know how it is in the latest versions. I see more

Permalink•Reply•Plus•0 pluses

A very serious security issue in version 6.0

Blogs

Help

Product

Company