vBulletin 4.X Security Patch

vBulletin Publishing suite and Forum Classic

• 4.1.4pl2
• 4.1.3pl2
• 4.1.2pl2
• 4.1.1pl2
• 4.1.0pl4
• 4.0.8pl4
• 4.0.7pl2
• 4.0.6pl3
• 4.0.5pl2
• 4.0.4pl3
• 4.0.3pl3
• 4.0.2pl6
• 4.0.1pl2
• 4.0.0pl3

Has been released.

An additional flaw within a side query that is used in the search UI has recently been discovered. This is further to a previous patch that was issued. This flaw may enable malicious individuals to inject sql that would allow you to run arbitrary queries on the db via this exploit. To resolve this issue, it has been necessary to release a patch level version on all versions of vBulletin 4.X. The issue does not affect vBulletin 3.X to the best of our knowledge. We are not aware of a website that has been compromised by this flaw.

The upgrade process is the same as previous patch level releases - simply download the patch from the Members Area, extract the files and upload to your webserver, overwriting the existing files. There is no upgrade script required.

As with all security-based releases, we recommend that all customers upgrade as soon as possible in order to prevent any potential damage resulting from the flaw being exploited.


Upgrading from 4.X

If you are already running 4.X, the process you will be required to follow to make your board immune to this flaw is very simple.

Visit the Patches section of the vBulletin Members' Area and download the patch for the version you are using, then extract the files from the archive you downloaded, then upload the files to your board via FTP etc., overwriting the existing files. This will update your version to the PL1 release.


Thank you to user altex for reporting the issue to us.


Continue reading...

 

when are they going to learn to check, double check and triple check for such flaws before releasing their software, I think they need a new QA team...