Exploit in 3.7 - Any words about it?

[Hossie]

Could not find a thread about it here yet - from this thread at vBGermany. What about the exploit posted at Security Focus (http://www.securityfocus.com/archive/1/492290)? For me, the example query at least generates a database error (which then triggers an email) - so at least this should be fixed. Any word from a developer? What Martin said in that thread on securityfocus.com doenst seem to be completely true.

[zCarot [RU]]

This is just a bug. Forum can not be hacked through this

[Hossie]

So at least the database error should be fixed.

[Hossie]

http://www.vbulletin-germany.com/for...20&postcount=7

Close please.

€: For those who do not speak german: It can't be exploited, nothing more than the database error. Replace the code from the first code with that from the second.

[David Grove]

It's fixed http://www.vbulletin.com/forum/proje...?issueid=25377 http://www.vbulletin.com/forum/proje...?issueid=25586