Security Flaw Allowing Unauthorized Access to User Accounts

[Alucqrd]

I'm experiencing a critical security issue with my IPB installation (v4.4.10):

1. Problem: A security flaw is allowing unauthorized access to user accounts, resulting in spam messages across the board.
2. Attempted Solutions:
   • Attempted to update PHP to version 8.2 in my Docker container, but this caused functionality issues for users.
   • Tried updating the board, but the process times out.
3. Current Situation: The board remains vulnerable to this attack.
4. Specific Request: I urgently need a security patch or guidance to address this account compromise issue without requiring a full board update or major configuration changes (custom theme).
5. Constraints: A full update would require significant changes to my Docker configuration and PHP version, and would make my current template obsolete.

Please provide a targeted solution to fix this security vulnerability as soon as possible. Any interim measures to protect user accounts would also be greatly appreciated.

Thank you for your help.

[Marc]

You are going to need to do a full upgrade. There is nothing I can give you to patch any vulnerabilities that have been patched throughout the 36 releases you are behind in software updates. You need to get together with your host to find out why your hosting is timing out.

PHP 8.2 indeed will not work. You need to be using PHP 8.1. But I think you may be that far behind, you will need to upload all files, then switch to 8.1, then perform the upgrade. The reality is, the version you are using is coming up to being half a decade old. 

In terms of the issue itself. Could I ask if you are 100% sure its a vulnerability that is causing your issue? Have you changed passwords on any of the accounts in question to see if its still occuring? What you describe sounds very much like it could be account passwords that are being used, perhaps that have been gotten hold of somewhere outside of the software.