FAQ database error

[Umut Ceylan]

Hello
i've recevied this database error email what is the problem
best regards
Cheers

Database error in vBulletin 3.7.0:

Invalid SQL:

SELECT varname AS faqname, fieldname
FROM phrase AS phrase
WHERE phraseid IN(156033, 156034, 156035, 156036, 156037, 156038, 156039, 156040, 156041, 156042, 156043, 156044, 156045, 156046, 156047, 156048, 156049, 156050, 156051, 156052, 156053, 156054, 156055, 156056, 156057, 156058, 156059, 156060, 156061, 156062, 156063, 156064, 156065, 156066, 156067, 156068, 156069, 156070, 156071, 156072, 156073, 156074, 156075, 156076, 156077, 156078, 156079, 156080, 156081, 156082, 156083, 156084, 156085, 156086, 156087, 156088, 156089, 156090, 156091, 156092, 156093, 156094, 156095, 156096, 156097, 156098, 156099, 156100, 156101, 156102, 156103, 156104, 156105, 156106, 156107, 156108, 156109, 156110, 156111, 156112, 156113, 156114, 156115, 156116, 25814, 138180, 138181, 138182, 138183, 138184, 138185, 138186, 138187, 138188, 138189, 138190, 138191, 138192, 138193, 138194, 138195, 138196, 138197, 138198, 138199, 138200, 138201, 138202, 138203, 138204, 138205, 138206, 138207, 138208, 138209, 138210, 138211, 138212, 25780, 138213, 138214, 138215, 138216, 138217, 138218, 138219, 138220, 138221, 138222, 138223, 138224, 138225, 138226, 138227, 138228, 138229, 138230, 138231, 138232, 138233, 138234, 138235, 138236, 138237, 138238, 138239, 138240, 138241, 138242, 138243, 138244, 138245)
AND ();

MySQL Error : You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ')' at line 4
Error Number : 1064
Request Date : Wednesday, May 21st 2008 @ 10:09:14 PM
Error Date : Wednesday, May 21st 2008 @ 10:09:14 PM
Script : http://www.xxxxxxx/forum/faq.php?do=search&q=*&match=all&titlesonly=0
Referrer : http://www.xxxx.com/forum/faq.php
IP Address : 78.176.103.109
Username : storm75
Classname : vB_Database
MySQL Version :

[OMP]

This is someone testing your forums for some new SQl Injection involving the faq.php file. It has been posted on some security websites as a new exploit. Jelsoft has stated that the exploit is not valid, but some security sites are reporting it as a tested and working exploit.

[Steve Machol]

Invalid SQL errors are almost always related to modified code. To troubleshoot this, the first thing you need to do is remove any third-pary hacks or plugins, then see if you still have this problem.

If so, reupload all the original vB non-image files (except install.php). Make sure you upload these in ASCII format and overwrite the ones on the server.

Next, create a new style and choose no parent style. This will force it to use the default templates. Finally empty your browser cache, close all browser windows then try again. Make sure you change to the new style and view your forums with it. Do you have the same problem?

[OMP]

Invalid SQL errors are almost always related to modified code. To troubleshoot this, the first thing you need to do is remove any third-pary hacks or plugins, then see if you still have this problem.

If so, reupload all the original vB non-image files (except install.php). Make sure you upload these in ASCII format and overwrite the ones on the server.

Next, create a new style and choose no parent style. This will force it to use the default templates. Finally empty your browser cache, close all browser windows then try again. Make sure you change to the new style and view your forums with it. Do you have the same problem?

There is nothing wrong with the database or files. Look at the error and the URL which is someone trying to exploit the faq.php.

Script : http://www.xxxxxxx/forum/faq.php?do=search&q=*&match=all&titlesonly=0
Referrer : http://www.xxxx.com/forum/faq.php

Server is just sending a warning cuz of this persons attempt at the database.

[Umut Ceylan]

yes i agree OMP

http://www.securityfocus.com/bid/29293/info

its may be sql exploit
how can I stoped this attack
best Regards

[packetattack]

SQL Injection

Invalid SQL errors are almost always related to modified code. To troubleshoot this, the first thing you need to do is remove any third-pary hacks or plugins, then see if you still have this problem.

If so, reupload all the original vB non-image files (except install.php). Make sure you upload these in ASCII format and overwrite the ones on the server.

Next, create a new style and choose no parent style. This will force it to use the default templates. Finally empty your browser cache, close all browser windows then try again. Make sure you change to the new style and view your forums with it. Do you have the same problem?

This appears to be a real exploit no?

I do a lot of security web testing etc. in my day to day travels and both the FD and Bugtraq lists have this exploit posted.

A response from the vendor would be nice

[Wayne Luke]

It is not an exploit. You can't search for * by itself. It will return a database error because the query is malformed.

[David Grove]

http://www.vbulletin.com/forum/project.php?issueid=25377

[packetattack]

Exploit clarification.

It is not an exploit. You can't search for * by itself. It will return a database error because the query is malformed.

Thanks for clarifying. I feel better now.

[Umut Ceylan]

It is not an exploit. You can't search for * by itself. It will return a database error because the query is malformed.

Thanks for information