[ShiningStar]

Originally Posted by Zarxrax

Well, I was running a rather outdated version of the forum (my license for 3.x had expired, and I hadn't bought 4.x yet), so I'm sure there were plenty of security vulnerabilities in it. My database password was obtained from the config.php and then that was that.
I do know that the hacker obtained admin privileges on the board because right before it was defaced, some normal users were promoted to super moderators.

Yup, after getting Database info they can do almost everything what usually an Owner can do {downloading Database, editing tables so in this way promoting or demoting any member, or simply changing Admin's Email Address to their own so they could easily recover Password of Super Admin Too }, it usually takes a few minutes in making themselves Admin, but all that is possible only from that of the Server where you are Hosted & it's not a matter at all to know about other sites of the same server as well as to Hack any of the other Forum hosted on that server.
While Security issues aren't there in vBulletin itself, when it comes to 3X then using latest version i.e. 3.8.7 PL-2 may be the Best Idea {even I like to have & work in 3.8.7 },
So only Security from you can be that of the Securing Config.php file by it's permissions {some times 400 won't let Forum work, in this situation CHMOD 404 will be used also an extra step of decrypting config.php may be taken too} but still there's one more danger that of the Resellers Account if Your Reseller or Master Reseller of Your Reseller gets Hacked then any of the Precaution will become useless itself as that Hacker will be able to Access Your CPanel