vBulletin Unsafe?

[MTGDarkness]

I doubt Jelsoft is hiring, and I dont know if I want to fix something as broken as vbulletin, its DB performance is horendous, its code implmentation is *cringe*, and I doubt they would like a formal AGILE method, altough I do hear they are adopting AGILE (a microsoft originating project mangement style that rocks)

But yes, VB hacking easy as pie, also there is a way to make users do things invisible, a user remote control if you will.

In my experiance the most I would get out reporting the 71 or so hacks I have found to date is a free copy of VB.

This guy claims he can hack vbulletin in 41 different ways with notepad and opera. How much is he bullshitting me?

[RedeemedWarrior]

Vbulletin is one of the most secure softwares on the net.

[MTGDarkness]

He gave me this example:

Ok here is a quick one.

Custom Sigs accept code, you could cross script it and send to the admin, that wuld cause the admin to load a page to change his pass and send it to you.

Or you could steal his cookie.

Of you could have him execute delete from on his entire db.

So all you do is mail the ++++ and let your custom kill him.


(code so he can't see it)

[Vackrick]

Man He is a liar man that what i can say what ur msn????

pm me ur msn i help u talk to that guy

[MTGDarkness]

Prolly not worth it. Honestly, I can tell he's probably lying. vBulletin couldn't be that unsafe.

[Stifler]

reverse engineering you to give up your password to someone who could supposedly "hack" you in order to protect you is usually how someone who talks a lot of game obtains 99.9% of their passwords.

[TigerC10]

He's a noob that found a list of the cross site scripting exploits on old versions of vB, pretty much if you're up to date his rants about insecurity are worthless.

The only thing he's somewhat right about is the cookie thing. If you log into your board on a public wireless network, anyone can sniff out your cookie without any problem. Once you that cookie is stolen they can do a lot of stuff without authorization until you change your password.

[ragtek]

And as you see, if a exploit is find, the developers are fixing it very fast => 3.8.1 pl 1

[Vackrick]

ya lor vb rox

[mac-warez]

Actually in the 4th post i believe. he is correct. You can Use an XSS flaw in some 3.6X versions of vBulletin

[TigerC10]

@mac-warez - Yeah, we know. That's what I was talking about before... Old versions.