[liamwli]

Originally Posted by MegaManSec

it has an sql injection in it. (probably more than just one)

	$vbulletin->input->clean_array_gpc('p', array(
		'vb_login_username'        => TYPE_STR,
		'vb_login_password'        => TYPE_STR,
		'vb_login_md5password'     => TYPE_STR,
		'vb_login_md5password_utf' => TYPE_STR,
		'postvars'                 => TYPE_BINARY,
		'cookieuser'               => TYPE_BOOL,
		'logintype'                => TYPE_STR,
		'cssprefs'                 => TYPE_STR,
		'inlineverify'             => TYPE_BOOL,
		'redirect'                 => TYPE_NOHTML));

	//get userinfo
	$userinfo = $vbulletin->db->query_first("SELECT * FROM " . TABLE_PREFIX . "user WHERE username='" . $vbulletin->GPC['vb_login_username'] . "'");

No, it doesn't. That code is only run if the username and password are correct.

Check the if statement at the top.

For this to work, someone would have to have a username that contained the SQLi.