My guestbook version 2.4.3 has been hacked

Hello again,

i found the table book_auth.Now all i have to do,is to change the password, right?Wanted to be sure,because the pass seems to be encrypted "2e3bf74742005f64".

I think it's version 2.3.x ,i made it with your carbonize script.

Try my reset script from www.carbonize.co.uk/AG or click the FAQ at http://lazarus.carbonize.co.uk

It worked.Thank you.

guys try to use lazaruz guestbook by carbz

I doubt they got in through 2.4.3.

Go to www.yoursite.com/guestbook/misc/forget_pass

There you will be asked for the name and password of the database used by your guestbook, and after that you will be able to enter a new password.

Something I don't understand anyway, is how to block ip´s like 087206213221 or some others that use only five numbers like 345-89.pl. One of my guestbooks is being hacked by owners of those kind of ip´s and it seems not to be possible to block them to put silly things at the book. But all of them comes from .pl (poland?)

AG just stored the hostname which I've always thought was stupid. It was one of the first things I changed for Lazarus.

Anyway try http://whois.domaintools.com to get the ip from the hostname.

Hello Everybody,

My guestbook (version 2.4.3.) also receives spam messages. I reinstalled the script, do not use the standard login and password and refuse html in the markup of the messages. Ofcourse this version includes the robot-check by using the image with a code that is needed before you can publish a new message.

Does anybody know how I can resolve this?

Thank you in advance.

Hi
I have just registered as I have been hacked twice now but only have 2.4.2. I am using Dataflame as my host and I do not know very mcuh about all of this and they loaded the Guestbook onto my site in the first place. Each time they have sorted the problem but yesterday I got 6 spam entries - all the same except the name. Dataflame suggested upgrading the Guestbook, but by the look of all these entries, that will not help! Any suggestions that an amatuer could deal with?

You have captcha enabled?

You should all be on the latest version.

I assume captcha is where you have have to copy the letters that appear in the box? This seems to be there automaticially and I can't see anywhere in my settings where it allows me to turn it on or off. Actually Dataflame have now installed the 2.4.3 version although it is not entirely working as the emoticons/ pictures are not appearing!

Open config.inc.php and edit the base_url.

Oh dear -I wish I knew what you meany by that! Or where to find it. Is that what captcha is then?

I have found where it says captcha.php on the LHS and there is a load of code on the RHS.

There is a line marked

$base_url = '';

Put your guestbooks url between the '