Okay so from my understanding based on what I've patched, the only method of firing the API command that would give read/write access to the filesystem and furthermore database extraction, requires being run from the main server IP or LB IP with the correct live streaming password. Alternatively you could try to exploit something else in XUI to call the API as localhost, like trying to get XUI to use file_get_contents().. but you'd still require the correct live streaming password.
But according to the logs, that's what someone has done, so it's possible! Now the live streaming password is derived from various variables including the license key, so a hacker with the right knowledge can derive the key if they knew the license key of the server... For those of you with cracked licenses, you all have the same license key! But for genuine users it would require a leak in theory...
Now if you've had an LB hacked into, they can look at the logs and get the live streaming password and they can also legitimately call the API. So the hacks coinciding with the leaked databases makes sense in this aspect.
Either way, you should update just incase.
Hello @GTAXUI, query, can you release the update only for version 1.5.5 since that version is lighter and uses less CPU and is the one that behaves best.?