No announcement yet.

vBulletin 4.X Security Patch

  • Filter
  • Time
  • Show
Clear All
new posts

  • vBulletin 4.X Security Patch

    vBulletin Publishing suite and Forum Classic
    • 4.1.4pl2
    • 4.1.3pl2
    • 4.1.2pl2
    • 4.1.1pl2
    • 4.1.0pl4
    • 4.0.8pl4
    • 4.0.7pl2
    • 4.0.6pl3
    • 4.0.5pl2
    • 4.0.4pl3
    • 4.0.3pl3
    • 4.0.2pl6
    • 4.0.1pl2
    • 4.0.0pl3
    Has been released.

    An additional flaw within a side query that is used in the search UI has recently been discovered. This is further to a previous patch that was issued. This flaw may enable malicious individuals to inject sql that would allow you to run arbitrary queries on the db via this exploit. To resolve this issue, it has been necessary to release a patch level version on all versions of vBulletin 4.X. The issue does not affect vBulletin 3.X to the best of our knowledge. We are not aware of a website that has been compromised by this flaw.

    The upgrade process is the same as previous patch level releases - simply download the patch from the Members Area, extract the files and upload to your webserver, overwriting the existing files. There is no upgrade script required.

    As with all security-based releases, we recommend that all customers upgrade as soon as possible in order to prevent any potential damage resulting from the flaw being exploited.

    Upgrading from 4.X

    If you are already running 4.X, the process you will be required to follow to make your board immune to this flaw is very simple.

    Visit the Patches section of the vBulletin Members' Area and download the patch for the version you are using, then extract the files from the archive you downloaded, then upload the files to your board via FTP etc., overwriting the existing files. This will update your version to the PL release.

    Thank you to user altex for reporting the issue to us.
    Last edited by IB Adrian; Tue 19 Jul '11, 9:30pm.

  • #2
    Please note
    You must use the patch specifically for the version of the software you have installed.
    i.e. if you have 4.0.2 installed, you need to utilize the patch for 4.0.2. Patches for older or newer versions may not work and/or may provide other complications.


    widgetinstance 262 (Related Topics) skipped due to lack of content & hide_module_if_empty option.