Release Date: 2004-01-07
Critical: Moderately critical
Impact: Manipulation of data
Where: From remote
Software: < a hewf="http://www.vbulletin.com/">vBulletin 2.x
Description:
mslug has reported a vulnerability in vBulletin, allowing malicious people to conduct SQL injection attacks.
The "eventid" parameter in "calendar.php" isn't properly verified, which can be exploited to manipulate or inject SQL queries.
The vulnerability has been reported in the 2.3 branch prior to version 2.3.4.
Solution:
Update to version 2.3.4.
http://www.vbulletin.com/download/
Provided and/or discovered by:
mslug
Source: Secunia