vB 4.1.4 - Vulnerable to SQL Injection?
 

So I have a few enemies online, and a few competitors.

One of them said they are going to hack my site using an SQL Injection Exploit. However, I think they are full of it. But just to be on the safe side, I thought I would post here to see what I can do to make sure it doesn't happen.

• How would I find out if my vB 4.1.4 is vulnerable to SQL Injection?
• If so, How would I fix that vulnerability if it is vulnerable?
  
• Or maybe vB has nothing to do with SQL Injection?
• Does it have to do with only my MySQL Server and/or PhpMyAdmin?

I also have an legit SSL Certificate, and have my site running on HTTPS throughout the entire site. I also have a legit wildcard subdomain SSL Certificate running on my PhpMyAdmin sub-domain, so my PhpMyAdmin sessions will be secure through an SSL Connection.

Note: I have my vB 4.1.4 running on my own Dedicated Server.

OS: Windows Server 2008 R2
CPU: Intel Xeon Quad Core CPU
RAM: 12GB ECC RAM
ISP: 90Mbps Download | 90Mbps Upload - Dedicated IP
NIC: 1 Gbps
Webserver: IIS 7.0 (Maybe 7.5, not really sure)
MySQL: Version 5.6
PhpMyAdmin: Version 4.1.9

If you need any more info, just ask. And thank you.

As far as I know there are no public exploits for 4.1.4, but you should upgrade to the latest version regardless. It's also possible that one of your plugins are vulnerable or that other software on your website is vulnerable.

Anything below 4.2.2 pl2 has unpatched security vulnerabilitys.

The only problem is, I have a very custom Style installed. I payed EdenWebs for it. But they made it for 4.1.4, if I update to 4.2.2 then I need to also get the style updated for 4.2.2.

Yeah, that's a part of running a site unfortunately. :(

You can post in the paid request forum asking if anyone can update the style. It's fairly painless for the most part, it just takes time to do correctly.

Well if you're very handy you could manually look at the changes of 4.1.4 vs the latest version and replace the code which will not affect the theme/templates. This will take a while and is rather difficult though. Upgrading would be the easiest.

Yeah spending the time to upgrade is the best bet, trying to some half assed patching on your own in not the best solution. :)

Your right. Its better to be safe then sorry.

I think i might install a full backup of my forum on one of my Sub-Domains, and try to update it on a test sub-domain first. Just to see if it will break it or not. If everything is good, I will update on my live site. I will have the Sub-Domain directory setup with a password, because i know vBulletin doesn't allow 2 vBulletin installations with a single License.

If the update does break my forum, then I will have to find a way to update my style to work with 4.2.2.

Thank you Ozzy, your always helpful!

And thanks everyone else too. Its greatly appreciated!!

I'm sure it will be fine. Worst case scenario you have to make some minor template/CSS changes.