[Jackal von ?RF]

Database error in vBulletin 3.6.4:

Invalid SQL:
UPDATE vb_editlog SET reason = fda WHERE postid = 354660;

MySQL Error  : Unknown column 'fda' in 'field list'
Error Number : 1054
Date         : Monday, January 8th 2007 @ 11:59:09 PM
Script       : http://foorumit.fffin.com/edithistory.php?do=restore&editid=5
Referrer     : 
IP Address   : x.x.x.x
Username     : Jackal von ?RF
Classname    : vb_database

This has not yet been fixed in v1.2.2. Also, the value needs to be escaped. If only single quotes are added to the query, it will make the database vulnerable to SQL injection attack:

Database error in vBulletin 3.6.4:

Invalid SQL:
UPDATE vb_editlog SET reason = 'aa ' bee' WHERE postid = 354660;

MySQL Error  : You have an error in your SQL syntax.  Check the manual that corresponds to your MySQL server version for the right syntax to use near 'bee' WHERE postid = 354660' at line 1
Error Number : 1064
Date         : Tuesday, January 9th 2007 @ 12:03:10 AM
Script       : http://foorumit.fffin.com/edithistory.php?do=restore&editid=6
Referrer     : 
IP Address   : x.x.x.x
Username     : Jackal von ?RF
Classname    : vb_database

I also found that the rest of your the code is vulnerable to SQL injection attacks. You must ALWAYS escape EVERY parameter that is put to an SQL query:

Database error in vBulletin 3.6.4:

Invalid SQL:
INSERT INTO vb_editlog (postid, userid, username, dateline, reason) VALUES('354660', '468', 'Jackal von ?RF', '1168294059', 'a ' b');

MySQL Error  : You have an error in your SQL syntax.  Check the manual that corresponds to your MySQL server version for the right syntax to use near 'b')' at line 1
Error Number : 1064
Date         : Tuesday, January 9th 2007 @ 12:07:39 AM
Script       : http://foorumit.fffin.com/edithistory.php?do=restore&editid=12
Referrer     : 
IP Address   : x.x.x.x
Username     : Jackal von ?RF
Classname    : vb_database

I've attached a version of edithistory.php where the above security holes have been fixed.

All users of PEH 1.2.2 (and below) are STRONGLY RECOMMENDED to apply this patch, or disable PEH.


PS: I noticed that there are more detailed instructions for installing PEH at http://www.my-vb.org/board/showthread.php?t=236 (fortunately I can read German, I'm worried about everybody else ). Could you also make the English instructions more detailed? Also, please include the instructions as a text file to the ZIP file, so that it would not be necessary to read this thread for the instructions.