Loading...
 
Skip to main content

Features / Usability

Forum List Topic List

You are viewing a reply to Admin Bypass flaw attack attempt
 
Thread actions
Print this page
  • Print all pages

    • Admin Bypass flaw attack attempt

    Posted by RandyH
    Rick Sapir / Tiki for Smarties wrote:

    This was addressed in a prior release . You should upgrade your Tiki ASAP. See
    https://tiki.org/article473-Security-Releases-of-all-Tiki-versions-since-16-3Question


    I am at a release that fixes the flaw so it presumably will not allow them to enter. But I cannot keep the admin account active long enough to upgrade to the absolute latest release!

    I just went ahead and put a deny line in my .htaccess for the class C network including the ISP and others nearby. Cuts out innocents but resolves the issue. Hopefully, they are just a bot and won't pay attention / notice and try to get around that with a VPN to somewhere else. Something they could do if the banning mechanism worked anyway. Guess the real long term solution is to remove menu / module items for login and add a recaptcha to the login PHP page itself. Or allow a site-set initial admin account name.

    But would still like to know if I can safely rename the main, first admin account to something not so easily determined.

    Reads: 327