SQL injection vulnerability

Mendo Cath

Mendo Cath

Voidbringer
Aes Sedai
Joined
Apr 2, 2013
Messages
4,925
Howdy,

Last night we discovered the TarValon.Net forums were the active target of a SQL injection vulnerability.

We have made adjustments to clear up the vulnerability and are investigating logs.

At this time we know the attackers were successful in gaining access to the email addresses, forum usernames, and password hashes for all of our users.

We will be resetting all forum passwords and users are strongly advised to change their passwords for any other sites they may be using passwords identical to the one used on the TarValon.Net forum.

To reset your own password after logging in you can go to the reset password screen in User Settings.

If you are unable to login to your account to change your password you can use the Lost Password process to reset your password.

If you have any issues please contact us via the contact support page.

-Mendo Cath
Director of Technology
 
Last edited by a moderator:
Alora Sionn

Alora Sionn

Mama Wolf
Gaidin
Joined
Oct 30, 2012
Messages
44,978
Thank you Mendo Sedai, changed my password! :hug
 
Rhed al'Tere

Rhed al'Tere

Aes Sedai
Joined
May 4, 2002
Messages
14,069
Location
Durham, NC
Pronouns
  1. She - Her
Thank you to Mendo, Defen, and the rest of the Tech team for your quick action on this. We're in good hands!
 
Sabriane Diamodred

Sabriane Diamodred

Aes Sedai
Joined
Apr 7, 2013
Messages
1,733
Location
London, UK
Pronouns
  1. She - Her
changed but some forums such as local events and euro party forums are showing up as 'private' and i cant access them
 
Deleios Cherchenuit

Deleios Cherchenuit

Necroposter
Aes Sedai
Joined
Mar 16, 2011
Messages
13,029
Age
41
Location
Near Paris, France
Are users that have had their data accessed identified?
 
Lenore Carvoe

Lenore Carvoe

Aes Sedai
Joined
Sep 11, 2007
Messages
3,500
Location
Germany
Pronouns
  1. She - Her
That's why I had to change my password right now. Thanks for the information!
 
Mendo Cath

Mendo Cath

Voidbringer
Aes Sedai
Joined
Apr 2, 2013
Messages
4,925
Sabriane Diamodred said:
changed but some forums such as local events and euro party forums are showing up as 'private' and i cant access them
Click to expand...
When was the last time you logged in?
You may need to see this:
https://www.tarvalon.net/showthread.php?23374-Why-can-t-I-see-certain-forums

Please send an email over to me and membership or your admin if your still having issues.

Deleios Cherchenuit said:
Are users that have had their data accessed identified?
Click to expand...
Not at this time, we may not be able to identify individual users but we are reviewing logs.
 
Dnae Ila

Dnae Ila

Gaidin
Joined
Jun 12, 2014
Messages
12,210
Age
37
Location
New York
Pronouns
  1. Any - All
Thank you for letting us know so quickly!
Unfortunately, I've used that password on a lot of non-identification, non-financial stuff, so I've got a lot of password changing to do.
 
Qamra Daielin

Qamra Daielin

Tech Documentation Orderly
Aes Sedai
Director of Technology
Joined
Aug 27, 2006
Messages
7,048
Location
Calgary, Canada
Pronouns
  1. She - Her
Crazy, who would have thought this site would be a target? Anywho, because everything else of mine pretty much requires rolling passwords, none of them are in sync anymore... lol.
 
Sailea Nerid

Sailea Nerid

Aes Sedai
Joined
Jan 17, 2014
Messages
13,173
Age
35
Location
Belgium
Thanks for the quick reaction.
 
Stephen Lightheart

Stephen Lightheart

Joined
Sep 12, 2010
Messages
11,703
Location
The Netherlands
Pronouns
  1. He - Him
Discord
Lightheart#7487
Will I need to change my passwords elsewhere as well?
 
Sabriane Diamodred

Sabriane Diamodred

Aes Sedai
Joined
Apr 7, 2013
Messages
1,733
Location
London, UK
Pronouns
  1. She - Her
Mendo Cath said:
When was the last time you logged in?
You may need to see this:
https://www.tarvalon.net/showthread.php?23374-Why-can-t-I-see-certain-forums

Please send an email over to me and membership or your admin if your still having issues.


Not at this time, we may not be able to identify individual users but we are reviewing logs.
Click to expand...

ive been logged in recently, definitely not removed in cleanup or had status change in ages. only after this password change a bunch of forums are now private
 
Qamra Daielin

Qamra Daielin

Tech Documentation Orderly
Aes Sedai
Director of Technology
Joined
Aug 27, 2006
Messages
7,048
Location
Calgary, Canada
Pronouns
  1. She - Her
Stephen Lightheart said:
Will I need to change my passwords elsewhere as well?
Click to expand...

If you used the same username/email/password combination, then it would be a very smart thing to do. If they were different, you will be OK!
 
Cahalan Sothron

Cahalan Sothron

Meme and Money Queen
Aes Sedai
Joined
Feb 10, 2015
Messages
17,833
Age
50
Location
Georgia
Pronouns
  1. She - Her
Discord
Maihgread#0
Qamra Daielin said:
If you used the same username/email/password combination, then it would be a very smart thing to do. If they were different, you will be OK!
Click to expand...

Thankfully, this is the only place I've ever used this name combination! Although, I may still change my google passwords as I do have a saowynn account, and I did briefly use that name here, too.
 
You must log in or register to reply here.
Top