NMA was hacked earlier today and the hacker left the following message:<blockquote>Dear NMA-Fallout.com Forum Users,
I regret to inform you that NMA-Fallout.com staff seems to not give much of a fuck about security.
The URL http://www.nma-fallout.com/article.php gave me access to all databases because the GET parameter 'id' is unescaped numeric injectable with 1 parenthesis. I then stumbled upon Odin's account in the phpBB database and cracked the MD5 of his ridiculously weak password (it's "" BTW). After deleting his two "sticky" posts I decided to "backup" the whole phpBB database to my computer.
I don't want to harm any users and I will not sell or otherwise use the numerous passwords and email adresses I obtained. I only want to remind NMA-Fallout.com staff about the importance of website security.
After this message got deleted the first time I resent it as a Mass Email so every user gets to know Razz
I also banned all the Moderator Accounts except for Odin's.</blockquote>Props for hacking a site using quite old code also on taking a backup of the database, that shows that you just wanted to warn us. Next time send me an email or PM instead.
I regret to inform you that NMA-Fallout.com staff seems to not give much of a fuck about security.
The URL http://www.nma-fallout.com/article.php gave me access to all databases because the GET parameter 'id' is unescaped numeric injectable with 1 parenthesis. I then stumbled upon Odin's account in the phpBB database and cracked the MD5 of his ridiculously weak password (it's "" BTW). After deleting his two "sticky" posts I decided to "backup" the whole phpBB database to my computer.
I don't want to harm any users and I will not sell or otherwise use the numerous passwords and email adresses I obtained. I only want to remind NMA-Fallout.com staff about the importance of website security.
After this message got deleted the first time I resent it as a Mass Email so every user gets to know Razz
I also banned all the Moderator Accounts except for Odin's.</blockquote>Props for hacking a site using quite old code also on taking a backup of the database, that shows that you just wanted to warn us. Next time send me an email or PM instead.