[greyhat]

Personally I consider the config.php to be vbulletin's biggest security problem. If the file can be read (and I believe it requires the httpd to have read and execute, please correct me if I'm wrong).As if you know the user/pass for MySQL an attacker can connect to the database and get up to all sorts of mischief.

I'd like to encrypt (not just encode) config.php but any product that'll do this costs a few hundred $$ if not more.

If config.php is renamed and put in a dir with only execute on it, it'll stop anyone finding it easily if PHP safe mode is on as well.

If the file can be read by an attacker they can connect to the database then create themselves an admin user or alter an admin user's password hash in MySQL.

Works great in 3.6.2