Guest Posted New Topic (shouldn't have occurred) - hacked?

[me314159]

A few days ago someone, a Guest, posted a new topic on my forum.   I'm running SMF 2.0.11 and I use that with Tapatalk.   My forum is setup with a default installation.  I did check to make sure that a Guest CANNOT create a post - and as near as I can see from the admin configuration this is the case - guests don't have permission to post.   Maybe this has something to do with Tapatalk?    Perhaps I should have a look at whatever log files might be available?     Any other ideas?   

- Me

[Kindred]

it is, 100% due to tapatalk.

[Looking]

Any reason you have not upgraded to 2.0.15?

[Kindred]

oh yeah... that's the other thing.


uninstall tapatalk and update your SMF installation.

the first because tapatalk is terrible about updates (heck they are asking people to use their internal system rather than stay with SMF)
Tapatalk is known to have configuration issues that bypass standard SMF security.


the second because you are 4 versions behind, including security updates

[Veee]

Strange... I have seen random people leaving comments on my forum through the tapatalk app, but those comments never get posted on the actual forum as I require members to be registered in order to post on the board. Do you have the "in-app registration" option activated? Perhaps that's why... Never had it happen to me. Maybe it's some glitch. Contact the tapatalk support, they might be able to help. Had an issue in the past with them and they were quick to fix it for me.

[Aleksi "Lex" Kilpinen]

Strange... I have seen random people leaving comments on my forum through the tapatalk app, but those comments never get posted on the actual forum as I require members to be registered in order to post on the board. Do you have the "in-app registration" option activated? Perhaps that's why... Never had it happen to me. Maybe it's some glitch. Contact the tapatalk support, they might be able to help. Had an issue in the past with them and they were quick to fix it for me.

You have been lucky then, I've sometimes seen them dodge security issues for ages, and even keeping the issues a secret when releasing a fix.
I guess they are just trying to keep up an appearance, but that's the wrong way to do it...