Prelude to 2.2.9 - very important security fix!
 

All vBulletin versions from 2.0.0 to 2.2.8 have a cross-scripting security loophole that allows people to get member's usernames and passwords off your forum by doing something quite simple.

A fix is provided while the vB team organizes version 2.2.9 -

Read about it here:

http://www.vbulletin.com/forum/showt...threadid=57025

John posted a replacement global.php in vB.com's announcement forum, but PPN posted a more updated global.php at the bottom of this page:

http://www.vbulletin.com/forum/showt...5&pagenumber=5

Do upgrade to protect the security of your site. A friendly reminder post for vB admins. :)

thanks for posting it here ;)

Thanks:)

Satan

Thanks

- miSt

Yup.. it was fun playing with that.

I have been trying all day can't get anyones passwords :'(

_Arunan

^ me too :(

- miSt

:cry:

-Arunan

tell me bout it ^

I was well upset..

- miSt

Lol...

Satan

when will the madness end? ;) I guess this means the end of the line for the ver 2 series since 2.2.9 will be coming out, eh? vB 3 here we come. LOL

I doubt it will be the end of line of v2 unless vB3 is almost finished.

So, what's next ver 2.2.9.1 ? LOL

You need to be logged out to do it. Trust me, it can be done. Plus, you shouldn't be doing it. ;)

I was able to get all my users passwords from it ;)

For those who have hacked your global.php, and want to manually upgrade your global.php (this is the global.php in your FORUMS directory, not the admin one):

Follow the instructions in this post:

http://www.vbulletin.com/forum/showt...467#post363467

Good ol' PMA, eh? :p

*runs off crying* at the lack of knowledge :(

- miSt