[stangger5]

Starting with 2.7.1+

To fix that exploit was to edit one line..

PHP Code:

$ibforums->input['s_id'] = ibp_cleansql($ibforums->input['s_id']); 


change to

PHP Code:

$ibforums->input['s_id'] = intval($ibforums->input['s_id']); 


Originally Posted by BirdOPrey5

Comment should be OK because of they way strings are put in the database. The problem was s_id was allowed to be a string when it was supposed to be an int, that is what allowed the exploit.

The ibp_cleansql function needs to be changed to accept a second argument that says what type of data it is (string or int) and clean it differently depending on what it is supposed to be.

vBulletin has built in cleaning functions too that can/should be used.