[ragtek]

hi
in this product is a xss flaw!!!
and evercraft was since october not online


for the users:

update the when saving an event, create or update the associated thread plugin

PHP Code:

 // update the existing thread
        $this->dbobject->query_write("
            UPDATE " . TABLE_PREFIX . "thread
            SET lv_vb_eventforums_eventid = " . intval($this->fetch_field('eventid')) . ",
            forumid = " . intval($lv_vb_eventforums_forumid) . ",
            title = '" . $this->dbobject->escape_string(htmlspecialchars_uni($lv_vb_eventforums_threadtitle)) . "'
            WHERE threadid = " . intval($this->fetch_field('lv_vb_eventforums_threadid')) . "
        "); 


thx to andreas
but he means that it is possible that here are more flaws, but he didn check anything, just the one "big" hole