Admin member without permissions

[Gentleman99]

Hello there.
I got a SMF 2.0.2 board and running really great but somehow there's a member who is able to give himself admins permissions. He's "friendly" and has no bad intentions but i checked every permission and he's not doing any "additional groups" - he also has no password of any moderator (checked logs and changed personally every password also mine) and changed passwords of server/hosting/cpanel/ftp ...everything. Nothing on him but it gives me sense of "stupidity" because he can do everything he wants with MY forum and if another one comes with his same "powers" he could destroy our forum... how this is possible? i'm 100% safe on giving him passwords and changed them one by one 3 times in 2 days... but this scares me.

Hope i wrote everything good and you can understand, i'm italian.

[emanuele]

Ciao Gentleman99 e benvenuto su sm.org!

Well...no, to me it's not completely clear, in particular this part:

and changed passwords of server/hosting/cpanel/ftp ...everything.

If he can change the password of your cpanel...well, that's a bit scary and you probably have some bigger problem there...

If you feel more comfortable, you can come to the Italian board and explain your the issue in Italian so that we can understand each other better.

[Arantor]

First step: do a virus check on your computer.

[Gentleman99]

See you there! Thx
http://www.simplemachines.org/community/index.php?topic=483390.0

[Mstcool]

I think he said that GentleMan changed his own password for cpanel and all that stuff not the guy who has admin powers.

[Gentleman99]

I think he said that GentleMan changed his own password for cpanel and all that stuff not the guy who has admin powers.

Yes. For security reason I changed all passwords related to cpanel and other stuff, but he still has the powers.
Now I'm solving this with emanuele in Italian support, but thank you!

[Mstcool]

Good Luck with it!

[Arantor]

Well, there's been no resolution of this, but if there's no additional groups or anything (and he's not in the master admin group), that either means he has some permissions granted by something else, or the core code has already been changed in some other fashion.

Fresh set of files would eliminate the latter, the user's profile > permissions should eliminate the former.

Also, it's possible that this can happen in the event of deleting the 0-member post count group.

Pending further information/investigation I'm going to move this to the closed reports board simply because without further information we can't do anything, and it's been a long time without any follow-ups (so I kind of assume the problem has gone away)