v3.4 did have a few SQL Injection vulnerabilities that are fixed in v3.4.01. But, they did require a person to actually save the form, edit it and add code to it, and then submit it from their saved form.
v3.4.01 will be released in less than 24 hours. (probably more like less than 12 hours) I get off from work in about 6 hours. So it will be after that.
of the 3 people who have a M_LEVEL of 3 are they all supposed to be admins?
Unless this person tells you exactly how they are hacking your forum (if they really are), I don't know if it's fixed. I can't tell from your database if it was hacked, or how it was hacked.
You said that this was a brand new v3.4 install, when in fact it was an upgrade from an earlier version. your forum could have been hacked before you upgraded and they just waited until afterwards to do any damage to it.
Have you read my responses above? I do not know exactly how this person is hacking your forum (if they even are). Your forum could have already been hacked before you upgraded it.
Topic Locked
Posted - 23 August 2002 : 21:15:33
? 
Nathan Bales