[Forum] High Risk ?

[cyry]

Hello,
Is this a high risk vulnerabilityes ?
If YES , how to secure it ?
What is the best mode to secure my forum ?
Thanks.

<?xml version="1.0" encoding="utf-8"?>
<ROOT>
  <SiteVulList>
    <VulRow>
      <ReferURL>http://www.mydomain.com/calendar.php^s=75a2a98e2995cd8c601b75d3b6c7338a</ReferURL>
      <Parameter>s=75a2a98e2995cd8c601b75d3b6c7338a</Parameter>
      <Type>String</Type>
      <KWordActionURL>remotely</KWordActionURL>
      <Vulnerability>COOKIE SQL INJECTION</Vulnerability>
    </VulRow>
    <VulRow>
      <ReferURL>http://www.mydomain.com/search.php?s=75a2a98e2995cd8c601b75d3b6c7338a&amp;do=getnew^contenttype=vBForum_Post</ReferURL>
      <Parameter>contenttype=vBForum_Post</Parameter>
      <Type>String</Type>
      <KWordActionURL>remotely</KWordActionURL>
      <Vulnerability>COOKIE SQL INJECTION</Vulnerability>
    </VulRow>
    <VulRow>
      <ReferURL>http://www.mydomain.com/vbmail.php?s=99999999</ReferURL>
      <Parameter>s=99999999</Parameter>
      <Type>Integer</Type>
      <KWordActionURL>remotely</KWordActionURL>
      <Vulnerability>URL SQL INJECTION</Vulnerability>
    </VulRow>
    <VulRow>
      <ReferURL>http://www.mydomain.com/search.php?do=getdaily&amp;contenttype=vBForum_Post&amp;s=75a2a98e2995cd8c601b75d3b6c7338a</ReferURL>
      <Parameter>s=75a2a98e2995cd8c601b75d3b6c7338a</Parameter>
      <Type>String</Type>
      <KWordActionURL>document</KWordActionURL>
      <Vulnerability>URL SQL INJECTION</Vulnerability>
    </VulRow>
    <VulRow>
      <ReferURL>http://www.mydomain.com/forum.php?s=75a2a98e2995cd8c601b75d3b6c7338a</ReferURL>
      <Parameter>s=75a2a98e2995cd8c601b75d3b6c7338a</Parameter>
      <Type>String</Type>
      <KWordActionURL>remotely</KWordActionURL>
      <Vulnerability>URL SQL INJECTION</Vulnerability>
    </VulRow>
    <VulRow>
      <ReferURL>http://www.mydomain.com/forum.php?s=99999999</ReferURL>
      <Parameter>s=99999999</Parameter>
      <Type>String</Type>
      <KWordActionURL>remotely</KWordActionURL>
      <Vulnerability>URL SQL INJECTION</Vulnerability>
    </VulRow>
    <VulRow>
      <ReferURL>http://www.mydomain.com/thanks.php?s=75a2a98e2995cd8c601b75d3b6c7338a&amp;do=hottest</ReferURL>
      <Parameter>do=hottest</Parameter>
      <Type>String</Type>
      <KWordActionURL>remotely</KWordActionURL>
      <Vulnerability>URL SQL INJECTION</Vulnerability>
    </VulRow>
    <VulRow>
      <ReferURL>http://www.mydomain.com/thanks.php?do=statistics&amp;s=99999999</ReferURL>
      <Parameter>s=99999999</Parameter>
      <Type>String</Type>
      <KWordActionURL>remotely</KWordActionURL>
      <Vulnerability>URL SQL INJECTION</Vulnerability>
    </VulRow>
    <VulRow>
      <ReferURL>http://www.mydomain.com/forums/1-General-Category?s=75a2a98e2995cd8c601b75d3b6c7338a</ReferURL>
      <Parameter>s=75a2a98e2995cd8c601b75d3b6c7338a</Parameter>
      <Type>String</Type>
      <KWordActionURL>remotely</KWordActionURL>
      <Vulnerability>URL SQL INJECTION</Vulnerability>
    </VulRow>
    <VulRow>
      <ReferURL>http://www.mydomain.com/forums/1-General-Category^s=75a2a98e2995cd8c601b75d3b6c7338a</ReferURL>
      <Parameter>s=75a2a98e2995cd8c601b75d3b6c7338a</Parameter>
      <Type>String</Type>
      <KWordActionURL>remotely</KWordActionURL>
      <Vulnerability>COOKIE SQL INJECTION</Vulnerability>
    </VulRow>
    <VulRow>
      <ReferURL>http://www.mydomain.com/forumdisplay.php?s=75a2a98e2995cd8c601b75d3b6c7338a&amp;do=markread^markreadhash=guest</ReferURL>
      <Parameter>markreadhash=guest</Parameter>
      <Type>String</Type>
      <KWordActionURL>remotely</KWordActionURL>
      <Vulnerability>COOKIE SQL INJECTION</Vulnerability>
    </VulRow>
    <VulRow>
      <ReferURL>http://www.mydomain.com/forumdisplay.php?do=markread&amp;markreadhash=guest&amp;s=99999999</ReferURL>
      <Parameter>s=99999999</Parameter>
      <Type>Integer</Type>
      <KWordActionURL>Rokco</KWordActionURL>
      <Vulnerability>URL SQL INJECTION</Vulnerability>
    </VulRow>
    <VulRow>
      <ReferURL>http://www.mydomain.com/forums/7-Rules-amp-Announcements^s=75a2a98e2995cd8c601b75d3b6c7338a</ReferURL>
      <Parameter>s=75a2a98e2995cd8c601b75d3b6c7338a</Parameter>
      <Type>String</Type>
      <KWordActionURL>remotely</KWordActionURL>
      <Vulnerability>COOKIE SQL INJECTION</Vulnerability>
    </VulRow>
    <VulRow>
      <ReferURL>http://www.mydomain.com/login.php?do=login^vb_login_password_hint=Password&amp;s=&amp;securitytoken=guest&amp;do=login&amp;vb_login_md5password=&amp;vb_login_md5password_utf=&amp;vb_login_username=User Name&amp;vb_login_password=WCRTESTINPUT000000</ReferURL>
      <Parameter>vb_login_password=!S!WCRTESTINPUT000000!E!</Parameter>
      <Type>String</Type>
      <KWordActionURL>entered</KWordActionURL>
      <Vulnerability>POST SQL INJECTION</Vulnerability>
    </VulRow>
    <VulRow>
      <ReferURL>http://www.mydomain.com/forums/4-Suggestions?s=99999999</ReferURL>
      <Parameter>s=99999999</Parameter>
      <Type>Integer</Type>
      <KWordActionURL>remotely</KWordActionURL>
      <Vulnerability>URL SQL INJECTION</Vulnerability>
    </VulRow>
    <VulRow>
      <ReferURL>http://www.mydomain.com/forums/6-Introductions?s=75a2a98e2995cd8c601b75d3b6c7338a</ReferURL>
      <Parameter>s=75a2a98e2995cd8c601b75d3b6c7338a</Parameter>
      <Type>String</Type>
      <KWordActionURL>remotely</KWordActionURL>
      <Vulnerability>URL SQL INJECTION</Vulnerability>
    </VulRow>
    <VulRow>
      <ReferURL>http://www.mydomain.com/forums/6-Introductions?s=99999999</ReferURL>
      <Parameter>s=99999999</Parameter>
      <Type>String</Type>
      <KWordActionURL>remotely</KWordActionURL>
      <Vulnerability>URL SQL INJECTION</Vulnerability>
    </VulRow>
    <VulRow>
      <ReferURL>http://www.mydomain.com/forum.php?styleid=5</ReferURL>
      <Parameter>styleid=5</Parameter>
      <Type>Integer</Type>
      <KWordActionURL>remotely</KWordActionURL>
      <Vulnerability>URL SQL INJECTION</Vulnerability>
    </VulRow>
  </SiteVulList>
</ROOT>

[Zachery]

I don't understand what that is you've shared with us?

[cyry]

I have received a PM in my forum with a text , was that vulnerabilityes .
I dont know,i just asking if is a risk or not .
I think is a scan of my forum or something.

[Wayne Luke]

Looks like a bunch of false positives or people are trying to scam you out of money. Each of those URLs proper URLs to access different features of vBulletin.

[cyry]

So ? is or not a risk

[BirdOPrey5]

We see no risks in those files, assuming you are running the latest version of 4.2.2.

[Zachery]

The thanks.php file, is from a third party vendor, you'd want to contact them about it.

[cyry]

We see no risks in those files, assuming you are running the latest version of 4.2.2.

Yes , i use the last 4.2.2 version .
Thanks .