Kryptronic Software Support Forum
You are viewing this forum as a guest. Login to an existing account, or create a new account, to reply to topics and to create new topics.
#1 01-20-2015 18:20:47
- dskowron
- Member
- Registered: 11-26-2008
- Posts: 138
Possible security breach - VERY BAD!!
I have two customers with the same last name. Both use their last name in their emails, but their emails are very distinctly different. One of these people used the link to have their password sent to them. He received the other person's password. So where do I go to find the SQL statement that is apparently using a wildcard operator in it to look up the password? This is bad.
Offline
#3 01-21-2015 09:30:34
- dskowron
- Member
- Registered: 11-26-2008
- Posts: 138
Re: Possible security breach - VERY BAD!!
webmaster wrote:
I think you more likely edited the core_users table directly and somehow got the username/email info for these two users set up with the same data.
What?? Negative. This is something that is wrong with the software. I did not edit the table! You have GOT to be kidding me!! This reply is unbelievable! Just unbelievable.
Offline
#4 01-21-2015 13:00:17
- kev
- Member
- Registered: 03-16-2009
- Posts: 399
Re: Possible security breach - VERY BAD!!
I have customers with the same last name but their username's and email addresses are different. Have you migrated your website between servers at any time or done any exports and imports of user data. That said it probably shouldn't have mattered as the email addresses and/or usernames must be different unless the customers are related and are using the same email address.
Offline
#5 01-21-2015 13:03:14
- dskowron
- Member
- Registered: 11-26-2008
- Posts: 138
Re: Possible security breach - VERY BAD!!
kev wrote:
I have customers with the same last name but their username's and email addresses are different. Have you migrated your website between servers at any time or done any exports and imports of user data. That said it probably shouldn't have mattered as the email addresses and/or usernames must be different unless the customers are related and are using the same email address.
We have the problem solved.
Offline
#6 01-21-2015 16:26:20
- zanart
- Member
- From: bedford
- Registered: 04-02-2008
- Posts: 1706
Re: Possible security breach - VERY BAD!!
What was the problem?
Rob
Offline