Feedback & Incident Report: Account Takeover Experience and Security Review Request

[zaintech]

Hello Developer,

First of all, thank you very much for creating and maintaining AdAdmin. I have been using your script to manage and display banner ads across all of my websites. It has always been an extremely helpful, well-organized, and reliable tool for my daily setup, and I truly appreciate the hard work you have put into it.

I am writing this not to complain or blame anyone, but simply to share a real incident that happened to me recently. I am completely non-technical with no background in programming or development—I only manage my websites through practical user experience. I wanted to bring this story to your attention so you can re-evaluate the application's security workflows and make it even safer for everyone who uses it.

---

What Happened

1. The Initial Attack:

• An attacker (or automated bot) began heavily targeting my e-commerce store with fake orders and repeated login attempts. Because the store has strict security, the attacker could not get in.
• Unable to break into the store directly, the attacker traced the banner code embedded on my web pages back to my standalone AdAdmin installation.

2. The Breach via Password Reset:

• The attacker tried to log directly into my AdAdmin panel. When that failed, they started targeting the "Forgot Password" / Password Reset feature.
• After just 3 or 4 reset attempts, the attacker somehow managed to bypass the system and gain full access to my admin account—even though they did not have access to my private email inbox.

3. The Damage:

• Once inside, the intruder replaced my email address and details with their own.
• They altered my banner configurations and deleted several of my active banners.
• Because I saw banners disappearing from my websites in real time, I tried to log in immediately, but my credentials were rejected. The "Forgot Password" link also failed because my registered email had already been overwritten.
• Panicking and trying to stop the attacker from causing further damage, I logged into my hosting control panel (cPanel) and tried to remove the compromised user data directly from the database. In the heat of the moment, I had to wipe the entire database and remove the installation completely to stop the intrusion.
• The attacker also grabbed my primary email address from the profile and used it to attempt unauthorized logins across several of my other online accounts.

---

A Humble Request from a User Perspective

As someone who relies on your software, I would be deeply grateful if you could look into the following areas whenever you review or update the script:

• Password Reset Workflow: Please review how the password reset process works to make sure no one can exploit or bypass it without actually receiving the link/code in their inbox.
• Account Takeover Prevention: Consider requiring confirmation (such as verifying the current password or sending a confirmation email to the old address) before an account’s primary email address can be changed.
• Brute-Force Protection: Look into stronger limits on failed login and password reset attempts, especially against attackers who keep switching their IP address.
• Two-Factor Authentication (2FA): If possible, adding an option for Two-Factor Authentication (like an authenticator app code) would give administrators peace of mind.
• Emergency Recovery: Consider a safe fallback method or documentation on how a legitimate site owner can regain access through their hosting panel if their web account is ever compromised.

---

Thank you again for your time, dedication, and effort on this project. I truly value your tool and only wanted to share this experience in hopes that it helps strengthen the script's protection in future updates.

[giuliopons]

Thank you very much for your report, I really appreciate it and I'm going to work on it today.
Giulio

[giuliopons]

I've added a draft vulnerability advisory and added you as a collaborator, I'll ask there some details. Please answer on that private discussion.