HackerSafe found potential vulnerability?

[pelicanparts]

HackerSafe just ran their testing on my new 3.7.0 installation, and came back with this:

Database error in vBulletin 3.7.0:
Invalid SQL:
SELECT varname AS faqname, fieldname
FROM phrase AS phrase
WHERE phraseid IN(40732, 40730, 40731, 40729, 40728, 40727, 40726, 40725, 40724, 40723, 40722, 40721, 40720, 40719, 40718, 40717, 40716, 40715, 40714, 40713, 40712, 40711, 40710, 40709, 40708, 40707, 40706, 40705, 40704, 40703, 40702, 40701, 40700, 40699, 40698, 40697, 40696, 40695, 40694, 40693, 40692, 40691, 40774, 40773, 40772, 40768, 40769, 40770, 40771, 40767, 40766, 40764, 40765, 40762, 40763, 40760, 40761, 40759, 40757, 40758, 40756, 40755, 40754, 40753, 40750, 40751, 40752, 40749, 40747, 40748, 40746, 40745, 40744, 40741, 40742, 40743, 40735, 40736, 40737, 40738, 40739, 40740, 40734, 40733, 31182, 31183, 31184, 31185, 31186, 31187, 31188, 31189, 31190, 31191, 31192, 31193, 31194, 31195, 31196, 31197, 31198, 31199, 31200, 31201, 31202, 31203, 31204, 31205, 31206, 31207, 31208, 31209, 31210, 31211, 31212, 31213, 31214, 31215, 31216, 31217, 31218, 31219, 31220, 31221, 31222, 31223, 31224, 31225, 31226, 31227, 31228, 31229, 31230, 31231, 31232, 31233, 31234, 31235, 31236, 31237, 31238, 31239, 31240, 31241, 31242, 31243, 31244, 31245, 31246, 31247)
AND ();
MySQL Error : You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ')' at line 4
Error Number : 1064
Request Date : Saturday, May 3rd 2008 @ 04:15:07 AM
Error Date : Saturday, May 3rd 2008 @ 04:15:07 AM
Script : http://forums.pelicanparts.com/faq.php?s=0&do=search&q=0&match=http%3A%2F%2Fwww.scanalert.com%2Fhelp%2Fscan ner%2F5%2Frfi%3F&titlesonly=0 (http://forums.pelicanparts.com/faq.php?s=0&do=search&q=0&match=http%3A%2F%2Fwww.scanalert.com%2Fhelp%2Fscan ner%2F5%2Frfi%3F&titlesonly=0)
Referrer : http://forums.pelicanparts.com:80/faq.php?s=%22Xx%3CXaXaXXaXaX%3ExX (http://forums.pelicanparts.com/faq.php?s=%22Xx%3CXaXaXXaXaX%3ExX)
IP Address : 165.193.42.135
Username : Unregistered
Classname : vB_Database
MySQL Version :

I've confirmed that the url above gives an error, but it doesn't do it on this site?

-Wayne

[Mike Sullivan]

That's a bug in 3.7.0: http://www.vbulletin.com/forum/project.php?issueid=25377

It's fixed for the next release. It's just an SQL error, not an injection or anything like that.

[pelicanparts]

Thanks, is there a quick fix for that in the meantime?

-Wayne

[Mike Sullivan]

I attached a patch to the bottom of that bug report. (View the highlighted version. Remove the code in red and add the code in green.)

[pelicanparts]

Thanks!

-Wayne