by Hello,
Yesterday, 14th of November, my (Pirata Nervo) GitHub account was compromised. By taking advantage of that, the attacker made a commit to our GH pages, more specifically one which is retrieved by the MyBB software in order to process version checks. Unfortunately, the attack allowed the attacker to setup Database backups of any MyBB forum, without exception, via JavaScript.
In order for you to know if you were attacked, you must have accessed the Admin CP of your forum from 14th November 23:00 GMT to 15th November 15:30 GMT. If you accessed your AdminCP during this timespan, it is likely that you were attacked.
To be sure about it, please log on to your AdminCP now and check your Database Backup Logs from ACP -> Tools & Maintenance -> Database Backups. If the creation date of at least one of them is set to a time between that time span mentioned above, you were affected. We strongly recommend you to alert your users about it so they can change their passwords.
What you have to do: (in case you were attacked)
Alert your users to change password.
Change your password.
Clear your cookies.
I’ve already enabled 2 Factor Authentication on my GitHub account and changed my password. I deeply apologize for this event for it was never my intention to cause any harm to anyone but it should be my responsibility to keep my account as secure as possible.
My apologies,
Pirata Nervo
Judging from this topic, if you accessed the ACP during that time, it made a backup of the usertable and uploaded it to a remote server - http://community.mybb.com/thread-162862.html
MyBB grabs data from mybb.com, trusts it and prints it out without checks or escapes. That allowed JavaScript to be inserted. Said JavaScript made your browser download your mybb_users table and upload it to a remote site.
Just a heads up!
