Mega exploit in 3.8.6

Discussion in 'Web Development and Programming' started by Brandon, Jul 21, 2010.

Brandon Regular Member

Joined:

Jun 1, 2009

Messages:

6,602

Likes Received:

1,706

Location:

Topeka, Kansas

First Name:

Brandon

This alert was posted by Floris at vbulletin.com

IB devs introduced a HUGEEEEEEEE oopsie in 3.8.5, which carried over to 3.8.6. (3.8.5 does not seem affected)

My buddy who made the vBulletin 4 to 3 downgrade script was tweaking his script and noticed the issue and tested it, which spit out the full database details to the 3.8.6 forum, a guest can query it.

I strongly recommend (if you run 3.8.6) to remove faq.php
and then change your mysql database details as a precaution.

Pitch (bug scrubber) was on IRC with us, assigned it to lead developer Kevin, so IB is now aware of it.
This way (we asked to create bug report), http://tracker.vbulletin.com/browse/VBIII-12798, and this thread, now customers are too.

Good luck everybody!
Click to expand...

Just wanted to toss this up for those who run forums

Brandon, Jul 21, 2010

#1
DaUnknownAdm!n Regular Member

Joined:

Mar 5, 2010

Messages:

254

Likes Received:

97

Location:

Brooklyn, New York

I know I'm a bit late on this, but I totally feel this latest fiasco is typical of the type of work that IB has been putting out since they took over vB.

DaUnknownAdm!n, Jul 27, 2010

#2
Cerberus Admin Talk Staff

Joined:

May 3, 2009

Messages:

1,031

Likes Received:

500

Wow, you can dump the whole database that easy?? I would consider that a serious problem LOL Hold on while I login as the admin LMAO

Cerberus, Jul 27, 2010

#3