WARNING: Mormondiscussions may be compromised

[_harmony]

I get rerouted (the last one was to Emma Watson), but my machine doens't load it. The message says Internet Explorer will not open this site. Your site is reloaded, and then MDB comes up.

Is that my safety net working?

[_MCB]

I have not had any problems with this at all. I saw down in the corner where it was going to Facebook on the way here, but even that quit. I am so disappointed that whatever it was did not target me.

[_Stormy Waters]

I recommend disabling javascript while the site remains compromised. Some things don't work but it's better then being sent to questionable websites and exposing yourself to potential security threats. You can change this in your browser settings. You will need to turn it back on for other sites to work properly.

[_Jason Bourne]

I was routed to some naughty porn site when logging in on my Ipad last night. So there are still issues.

[_Quasimodo]

I was routed to some naughty porn site when logging in on my Ipad last night. So there are still issues.

Are you complaining or rejoicing? by the way you have no avatar. You should reload it.

[_Dr. Shades]

Thanks for everything, Infymus. Unfortunately, I don't have access to any FTP codes, much less on the server end.

Anyway, shades, the trouble is in your style "Discussions". It's become compromised. If you want to fix it without my help or Mav's help you CAN go back to your default style. Just log into admin control, go to the STYLES tab, and set your style back to ProSilver (the default).

Okay, that's good to know. The "Discussions" style was based on the "Revival" style anyway, so I went ahead and made "Revival" the default style and eliminated "Discussions" entirely. Hopefully this did the trick. . . did it?

[_Yoda]

Thanks for everything, Infymus. Unfortunately, I don't have access to any FTP codes, much less on the server end.

Anyway, shades, the trouble is in your style "Discussions". It's become compromised. If you want to fix it without my help or Mav's help you CAN go back to your default style. Just log into admin control, go to the STYLES tab, and set your style back to ProSilver (the default).

Okay, that's good to know. The "Discussions" style was based on the "Revival" style anyway, so I went ahead and made "Revival" the default style and eliminated "Discussions" entirely. Hopefully this did the trick. . . did it?

Hey, Shades, in looking at the source code, I think you did the trick.

Is anyone still getting re-routed?

I am using Google Chrome at work, and have had no issues.

Members, please report here if you are still having issues.

Infymus, if you have a moment, can you also check the source code, just to see if I missed anything? I just did a brief look. Thanks!

[_Infymus]

Infymus, if you have a moment, can you also check the source code, just to see if I missed anything? I just did a brief look. Thanks!

The Google stuff is still there:

<script type="text/javascript">
var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.Joseph Smith' type='text/javascript'%3E%3C/script%3E"));
</script>
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-873263-1");
pageTracker._trackPageview();
} catch(err) { }</script>

But I don't see the bad script at this time. But of course I'm using FireFox with adBlock+ while at work.

I'll look at it when I can do it from home with IE and Chrome. Don't want to get re-routed to pr0n @ work.

[_Yoda]

Infymus, if you have a moment, can you also check the source code, just to see if I missed anything? I just did a brief look. Thanks!

The Google stuff is still there:

<script type="text/javascript">
var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.Joseph Smith' type='text/javascript'%3E%3C/script%3E"));
</script>
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-873263-1");
pageTracker._trackPageview();
} catch(err) { }</script>

But I don't see the bad script at this time. But of course I'm using FireFox with adBlock+ while at work.

I'll look at it when I can do it from home with IE and Chrome. Don't want to get re-routed to porn @ work.

I am currently on Chrome, and this is what I am seeing as well. No rerouting is taking place.

[_SteelHead]

Admin team needs to mitigate vulnerability or injection will just happen again. Should upgrade to the latest release of phpbb.