vB 4.1.4 - Vulnerable to SQL Injection?

[thetechgenius]

So I have a few enemies online, and a few competitors.

One of them said they are going to hack my site using an SQL Injection Exploit. However, I think they are full of it. But just to be on the safe side, I thought I would post here to see what I can do to make sure it doesn't happen.


How would I find out if my vB 4.1.4 is vulnerable to SQL Injection?
If so, How would I fix that vulnerability if it is vulnerable?

Or maybe vB has nothing to do with SQL Injection?
Does it have to do with only my MySQL Server and/or PhpMyAdmin?


I also have an legit SSL Certificate, and have my site running on HTTPS throughout the entire site. I also have a legit wildcard subdomain SSL Certificate running on my PhpMyAdmin sub-domain, so my PhpMyAdmin sessions will be secure through an SSL Connection.

Note: I have my vB 4.1.4 running on my own Dedicated Server.

OS: Windows Server 2008 R2
CPU: Intel Xeon Quad Core CPU
RAM: 12GB ECC RAM
ISP: 90Mbps Download | 90Mbps Upload - Dedicated IP
NIC: 1 Gbps
Webserver: IIS 7.0 (Maybe 7.5, not really sure)
MySQL: Version 5.6
PhpMyAdmin: Version 4.1.9

If you need any more info, just ask. And thank you.

[Dave]

As far as I know there are no public exploits for 4.1.4, but you should upgrade to the latest version regardless. It's also possible that one of your plugins are vulnerable or that other software on your website is vulnerable.

[ozzy47]

Anything below 4.2.2 pl2 has unpatched security vulnerabilitys.

[thetechgenius]

The only problem is, I have a very custom Style installed. I payed EdenWebs for it. But they made it for 4.1.4, if I update to 4.2.2 then I need to also get the style updated for 4.2.2.

[ozzy47]

Yeah, that's a part of running a site unfortunately. :(

[Brandon Sheley]

You can post in the paid request forum asking if anyone can update the style. It's fairly painless for the most part, it just takes time to do correctly.

[Dave]

Well if you're very handy you could manually look at the changes of 4.1.4 vs the latest version and replace the code which will not affect the theme/templates. This will take a while and is rather difficult though. Upgrading would be the easiest.

[ozzy47]

Yeah spending the time to upgrade is the best bet, trying to some half assed patching on your own in not the best solution. :)

[thetechgenius]

Yeah spending the time to upgrade is the best bet, trying to some half assed patching on your own in not the best solution. :)


Your right. Its better to be safe then sorry.

I think i might install a full backup of my forum on one of my Sub-Domains, and try to update it on a test sub-domain first. Just to see if it will break it or not. If everything is good, I will update on my live site. I will have the Sub-Domain directory setup with a password, because i know vBulletin doesn't allow 2 vBulletin installations with a single License.

If the update does break my forum, then I will have to find a way to update my style to work with 4.2.2.

Thank you Ozzy, your always helpful!

And thanks everyone else too. Its greatly appreciated!!

[Dave]

I'm sure it will be fine. Worst case scenario you have to make some minor template/CSS changes.

[ozzy47]

Well the main thing I can think of you may have issues with the navigation. Pre 4.2.0 did not use the Navigation Manager.

[Lynne]

Set up a test site and do an upgrade there first. Then you can modify your style, export it, and import it to the live site when you do the upgrade.

[thetechgenius]

Well the main thing I can think of you may have issues with the navigation. Pre 4.2.0 did not use the Navigation Manager.

Your right. I have all my Nav Tabs coded manually in the navbar template. So when I do upgrade, I probably wont use the Navigation Manager, and just code my Nav Tabs in the navbar template. So I don't run into any issues in the long run, I think if I do it that way, it will be less of a hassle.

What do you guys/girls think?

You have to remember, it took a lot of time, money and A LOT of patience to get my forum exactly the way I want it. I custom coded a lot of the features on my forum, including a lot of the Profile, the entire Postbit Legacy, the user info bar at the top, the sticky user info bar at the top that scrolls with the page, a modified Login Menu, the javascript loading bar at the top that loads with the page, a custom ShortURL System (with another Top Level Domain), a custom coded Anonymous URL System (an updated version from the one I posted on vb.org), and MUCH MUCH more. lol

Like I said, it took a long time, a lot of work, and a lot of patience, to get my forum exactly the way I want it, without errors.

[ozzy47]

It will take some work, but you are better off in the long run. Cause all the work you have done so far is no good if someone keeps hacking the site, because you did not upgrade. :)

[kh99]

I don't remember what changes were in what version, but I know that there were some template changes made where I believe they got rid of some of the 'bit' templates and instead used a vb:each loop in the main template. But if you do as Lynne suggested then you'll see where you stand before committing to anything.

[ozzy47]

Yeah there were a few minor tweaks hear and there. But it should not be overly difficult to sort.

[Paul M]

There is at least 1 known [recent] SQL Injection in 4.1.4 (it affects all 4.x.x versions as I recall), I vaguely recall at least 1 other as well.

Its quite an old version now, and several recent patches do not go back that far.

[ozzy47]

Yeah Paul, that is what I am saying. It's time to bite the bullet and do a upgrade, especially since he is on someones radar.

[thetechgenius]

I agree. I will do as Lynne suggested and install a backup of my forum on a Sub-Domain, and Password Protect the directory since its only for testing purposes. This way I can upgrade to the latest version of vB to see what I need to change in the style, without it affecting my Live Board if anything goes wrong.

Thank You Paul, Ozzy, Lynne and everyone else!! Its greatly appreciated!

[ozzy47]

Not a problem, let us know how it goes. :)