Evolution 1.0.7 Forgot Manager Login exploit still exists

Hi,

As Evolution 1.0.8 has not been announced yet, although downloadable I thought I would let you know that 1.0.7 still contains the Forgot Manager Login exploit.

We recently upgraded a site to EVO 1.0.7 which in turn upgraded the plugin to 1.1.4 however this morning we have noticed a few sites getting exploited via the Forgot Manager Login plug-in.

For now I have disabled this plug-in but it appears EVO 1.0.8 will fix this issue, also you could manually download the plug-in from the extras section version 1.1.6 is the latest.

Thanks aaron

There's not much point in going through the agony of completely upgrading all of Evo, just updating the plugin is all that's really necessary.

Evo 1.0.8 has been released: http://modx.com/download/evolution/ with the appropriate security notice: https://forums.modx.com/thread/81545/modx-evolution-1-0-7-and-prior-forgotmanager-plugin-vulnerability#dis-post-449818

It does look like there is no post made in the announcement section though; I'll let the team know.

Hi,

Thanks for the replies, I just re-read that notice and realised its telling users to upgrade I guess the subject and message content does not stand out straight away as I actually looked at that page earlier.

For now we are just disabling the forgot manager plugin on the sites as our customers don't use it often.

Do you know if the security notice emails still get sent out?

Thanks Aaron

Yes, I got it.

The announcement was just posted: https://forums.modx.com/thread/81645/modx-evolution-1-0-8-out-with-forgot-manager-plugin-security-fix/#dis-post-450371

Sorry for the delay

Cheers Mark much appreciated

Quote from: markh at Jan 14, 2013, 01:14 PM

The announcement was just posted: https://forums.modx.com/thread/81645/modx-evolution-1-0-8-out-with-forgot-manager-plugin-security-fix/#dis-post-450371

But the link Discuss Evolution 1.0.8 therein is leading to the Evolution 1.0.7 board. A new one for 1.0.8 should be created.

#EDIT#

I thought it had to be an other plugin which was causing a leak, seemed it was forgotmanager afterall.. I disabled it and still got hacked, but re-checking log files the hack was before I disabled it.


[ed. note: fourroses666 last edited this post 13 years, 8 months ago.]

Seemed everywhere there where index.php / one list.php / one blog.php files)

I had to reinstall a clean CMS and checked the plugins /mods which needed to be added on .php files. [ed. note: fourroses666 last edited this post 13 years, 8 months ago.]