VBulletin vBay module SQL Injection Vulnerability

Release date:
Updated on:

Affected Systems:
VBulletin vBay
Description:
--------------------------------------------------------------------------------
Bugtraq id: 56489
 
VBulletin is a powerful and flexible forum program suite that can be customized based on your needs. VBay can add the auction function to the vBulletin forum.
 
VBay 1.1.9 and other versions have the SQL injection vulnerability. After successful exploitation, the application can be controlled, data can be accessed or modified, and other vulnerabilities in the underlying database can be exploited.
 
<* Source: Dan UK
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:
 
VBulletin
---------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:
 
Http://www.vbulletin.org/forum/showthread.php? T = 132544