RevCMS News Exploit?

[uhHab]

Hey guys, I'm having an issue with my Hotel & i'm not sure if it's to do with the CMS or housekeeping, but I've removed as many exploits as I can possibly find apart from one.

I'm having an issue where users can somehow write a news article on my hotel? Now, They can't access the HK nor log in, as I've tested this on a normal rank account. I'm not sure how this could be possible or how they could write news articles without the correct rank or permissions?

I'm currently using RevCMS with ShockCMS 2.2 and HubbASE Housekeeping.

If anyone knows of this issue or knows of a fix, I'd really appreciate any help. I've had to temporarily delete my Housekeeping to stop allowing users using this exploit. This means that staff on my hotel are not currently able to write news articles and such.

Thank you in advance for any help you guys may offer me.

 

[BLuweesH]

Use a pin system to access staff accounts, this fixes 99% of exploiting. Although, I would check over your RevCMS and ASE files, make sure there's checking on permissions etc.

 

[uhHab]

Use a pin system to access staff accounts, this fixes 99% of exploiting. Although, I would check over your RevCMS and ASE files, make sure there's checking on permissions etc.

Thank you, I'll give that a try .

 

[LeChris]

Message me on Skype and I could look into this issue, chrismpettyjohn

It may be an issue with session checking, ie you may of testing if users could "login" on the housekeeping but they may just try to immediately access the dashboard or something else, which could be an issue in this case where the developer may of been lazy and not checked for rank when doing that

 

[BronzeSpider547]

Why the hell do you still use Revision CMS? This is so damn outdated and bad. If you can't create your own CMS or PHP files to work with MySQL, then you can't make a retro. You don't make a retro if you just download files and open it up. That's not even a tutorial on how to make a retro, it's a tutorial on how to download files.

 

[BLuweesH]

Hotels like Habboon still use RevCMS and credit the original owners; the engine is all there it's just about customizing it to how you like it. Look around at most hotels, they've always used good CMS releases such as HoloCMS, PHPRetro and RevCMS.

 

[Wuzix]

Why the hell do you still use Revision CMS? This is so damn outdated and bad. If you can't create your own CMS or PHP files to work with MySQL, then you can't make a retro. You don't make a retro if you just download files and open it up. That's not even a tutorial on how to make a retro, it's a tutorial on how to download files.

witch please, respect the newbies. You might be a newbie too, so respect the others.

 

[uhHab]

Message me on Skype and I could look into this issue, chrismpettyjohn

It may be an issue with session checking, ie you may of testing if users could "login" on the housekeeping but they may just try to immediately access the dashboard or something else, which could be an issue in this case where the developer may of been lazy and not checked for rank when doing that

I'll add you on skype now, all help is gratefully appreciated.

Why the hell do you still use Revision CMS? This is so damn outdated and bad. If you can't create your own CMS or PHP files to work with MySQL, then you can't make a retro. You don't make a retro if you just download files and open it up. That's not even a tutorial on how to make a retro, it's a tutorial on how to download files.

Just because I'm using RevCMS doesn't mean that I don't know how to make a Hotel. I know very basic php coding which I'm still learning as I go. I have no knowledge in making my own CMS, That still doesn't mean I don't know how to make a hotel? Like BluweesH said, Most of the big well known hotels use such CMS like RevCMS and such.

 

[BLuweesH]

I just wanted to add that this is Habbo. You WILL get beginners here learning to do new things? As a young developer, starting to learn the basics can be important as it's quite advanced code (for a beginner anyway) getting to know the knowledge behind your own projects could potentially benefit you in the future and be open to more pathways when introduced to college/university.

We're not all top end experts and we don't all make our own CMS' :glare:

 

[LeChris]

Why the hell do you still use Revision CMS? This is so damn outdated and bad. If you can't create your own CMS or PHP files to work with MySQL, then you can't make a retro. You don't make a retro if you just download files and open it up. That's not even a tutorial on how to make a retro, it's a tutorial on how to download files.

RevolutionCMS *
Why use mysql? There is mysqli_, and pdo_, or a higher up language than PHP...