 clownfire wrote:
It would be a shame if that is happening because that like item number 1 [a browser accessible directory] on the install instructions. |
The first risk of having the MDB in a browser accessible folder is that any browser can download the entire MDB all in one shot. That means that every email address you have in the database is wide open for the world to see (maybe we should think about encrypting the email address), every restricted forum is open, every username is known by the hacker. Now, the hacker has the hashed password, which is still pretty safe, but if the password is something simple like a dictionary word or just stupid, the hacker can perform a dictionary attack or even a brute force attack to determine the admin password. Such an attack is nearly impractical to run through the web interface.
So, assuming you changed the password from the default "letmein" and didn't change it to "admin123", and haven't sent a Private Message (which are stored in the exposed MDB) with the admin password, then the only security risk left is from the hacker somehow being able to upload a modified MDB back to the web server in the same location.
WWF will only allow a user to upload files to directories specified in the configuration record and only files with safe extensions like jpg and zip. So in order to upload the MDB with a new admin password hash, they had to modify the configuration record first, which they could not do without knowing the admin password.
As far as I can tell, except for a ridiculously simple admin password, the only way to truly hack the WWF MDB (even if it's stored in an unsafe location) is to compromise the host server.
IMHO
Topic Options
Post Options
Thanks(0)
