A site which will remain unnamed that was running 0.9.9.6 without the Username Hijacking Patch was hacked on the 24th of March, from IP 195.175.37.6 .

We have been on alert for this type of event since reading reports quoted from "Monty53" on another site, where he claimed to have gained unauthorized admin access to two sites running WebAPP version 0.9.9.6. I have seen the logs of these visits to the site that was hacked, and it is apparent that he was indeed able to gain access as "admin" username.

We recommend to install the recently released Username Hijacking Patch to help stop this from happening at your site and to watch for the next release of WebAPP to be released as a more complete solution to that and other security problems that have been uncovered since 0.9.9.6 release.

No one has tried to access this site using that exploit since the 20th when these actions were recorded in our data error log here for the web-app.org site:




You can see at the end of the recorded string for the visit the cookie values used by a would-be intruder who was caught by the data error in his cookie.

No sign of anything like this here since.