Security problem

[bran]

Hi all. Let me try to to sum this up as quickly as possibly. I have a website for my family and friends, I installed Burning Board Lite on it. I made a really basic, bare-bones photo gallery with comments. I started getting spam comments, lot of them. So I went into the forum admin and removed all privileges from guests - they cannot view anything if they are not logged in to an account. Then I added a little bit of code to the other sections of the site that check to see if the user is logged in to a forum account. If not, they get an error.

 

I still get spam. So I had it start recording the forum username of the comment poster (thinking maybe someone didn't logout on a public PC or had spyware or who knows). The spam comments are coming in under username '0', which in this case I assume means 'false', as in no username was detected.

 

I think (hope) I can finally end this by simply checking for a valid user account before posting a comment to the database. However, since it SHOULD be impossible to even access the page that posts the comments without an account, I have doubts.

 

Anyone have any ideas on how this could still be happening and/or how I can block it?

[cooldude832]

well if you have a login system (you should on any forum) then you can prevent non member spam.

Secondly if you track IP addresses of users you can find out who is screwing with you

Thirdly Captcha on registration slows spam bots

Fourthly keeping tabs on spammers and stopping they quickly is the best way to keep em away.

 

If you do catch one you should be able to report the problem to their ISP and maybe get them banned or something.

[bran]

Couple more details in response to cooldude's suggestions:

 

Captcha isn't needed. All registrations are approved manually.

I will have read up on the IP stuff. I don't know much about how to capture them or what to do with them afterward.

 

I do have a login system on the forum. I included the forum's global.php in a test page and then output all defined variables. I tested it while logged in and while logged out and felt like I could block spammers by simply saying:

if(!isset($wbbuserdata['username']){
access_error();
}

because when I was logged out, no username was shown in the defined variables. access_error() is one of the forum's functions that gets included by way of global.php, it just shows an error page and then does exit().

 

Also worth mentioning: all of the spam is on the photo gallery, never any on the forum.

[darkfreaks]

if you want to log IP's do this

<?php

$_SERVER['REMOTE_ADDR'];
?>

then make a MYSQL field called ip's to store it in.

[cooldude832]

make a tiered level membership and only allow the non basic users to uplaod images, thus a spamer can't upload

[bran]

Been poking around and looking at things. Three accounts had session hash turned on so that it displays in the URL. I only know a little bit about sessions; could a link including the session hash be used to access the page without being logged into an account?

[PFMaBiSmAd]

I just searched for "Burning Board Lite" on the net and the first page gives several results talking about security problems.

 

Visit the software author's web site to see if they have any patch/upgrade that addresses the problem you are currently having.

 

It is likely that sql or php code can be injected that is allowing a spammer to post or allowing him the ability to put his scripts on your site.