Problem: cannot create user in 3.8.2 using data manager.

[enkord]

Hi all. I have a problem with 3.8.2. There is a small script used to add user to forum.


gunroxinterface.php:
<?
define('VB_AREA', 'External');
define('SKIP_SESSIONCREATE', 1);
define('SKIP_USERINFO', 1);
define('CWD', '/home/gunrox/public_html/forum');
require_once(CWD . '/includes/init.php');

$userdata=&datamanager_init('User', $vbulletin, ERRTYPE_ARRAY);
$userdata->set("username", $_GET['login']);
$userdata->set("email", $_GET['email']);
$userdata->set("password", $_GET['password']);
$userdata->set("usergroupid", 3);
$date=date("Y-m-d", mktime(0, 0, 0, $_GET['month'], $_GET['day'], $_GET['year']));
$userdata->set("birthday", $date);

if (sizeof($userdata->errors)>0 && trim(implode("", $userdata->errors))!="") {
echo "Error: <br>";
foreach ($userdata->errors as $i)
echo $userdata->errors[$i]."<br>";
} else {
$userdata->save();
echo "success";
}


?>
It is called in GET from another script:

$result = implode("", file($url_root."forum/gunroxinterface.php?action=createaccount".
"&login=naohsons&password=naohsons&email=naohsons%40mailinator.com&day=1&month=1&year=1980"));
echo $result;The result of script
is Error: <br><br>

It is strange - $userdata->errors has empty item.

Please give me advice.

Thanks in advance!

[TheLastSuperman]

Well quit looking and help him Nex :p

[vbenhancer]

hey, don't ask me, Michael, i'm not into exploits ... rofl

actually, you can and will never be able to create a user by passing information via a url called by echo... this is what we call an exploit or xss insert, which is really not something you can do inside vBulletin because of all the data verifications process.

you must show us what you need instead, so we can bring a solution.