[SimCityForum]

I've discovered one can force a SQL error by adding a single quote to an URL for a registration confirmation (e.g. http://gfxcontests.com/register.html?a=act&u=312&i=19120597'). Apparently there isn't an error checking to clean URLs of stray single quotes before passing them into the SQL string to look for rules that belong to said URL.

A full version of the error result is:

Database error in vBulletin 3.5.3:

Invalid SQL:
SELECT * FROM tblruleshack 
			WHERE (fileurl LIKE 'http://gfxcontests.com/register.html?a=act&u=312&i=19120597'' AND exactmatch = 1 ) 
			OR (fileurl LIKE 'http://gfxcontests.com/register.html%' AND exactmatch = 0 ) AND active = 1 ORDER BY ruleid;

MySQL Error  : You have an error in your SQL syntax.  Check the manual that corresponds to your MySQL server version for the right syntax to use near 'http://gfxcontests.com/register.html%' AND exactmatch = 0 ) AND
Error Number : 1064
Date         : Thursday, May 4th 2006 @ 08:30:57 PM
Script       : http://gfxcontests.com/register.html?a=act&u=312&i=19120597'

Notice how feeding the extra single quote into the URL passes straight into the SQL statement. I could see someone exploiting this to force a SQL injection.

The solution to this error is to find the following statements in the product-rulesagreement.xml file;

 	 	$ruleneed = $vbulletin->db->query_first("SELECT * FROM " . TABLE_PREFIX . "ruleshack 
			WHERE (fileurl LIKE '" . $urluri . "' AND exactmatch = 1 ) 
			OR (fileurl LIKE '" . $scripturl1 . "%' AND exactmatch = 0 ) AND active = 1 ORDER BY ruleid");

AND

		$sql = "SELECT * from " . TABLE_PREFIX . "ruleshack 
			WHERE 
			(
			(forumid = $fid)
			OR 
			(fileurl LIKE '" . $urluri . "' AND exactmatch = 1 ) 
			OR 
			(fileurl LIKE '" . $scripturl1 . "%' AND exactmatch = 0 )
			OR 
			(forumid IN ($parents))
			) 
			AND 
			(ruleid not in (" . $vbulletin->userinfo['agreedrule'] . ")) 
			AND 
			active = 1 
			ORDER BY ruleid";

and add the following code above the two statements above:

 	  	$urluri = addslashes($urluri);
 	  	$scripturl1 = addslashes($scripturl1);

If you have already installed this mod, then use the plugin manager to find "Hook Location : parse_templates" and edit "Rules And User Agreement" to add in the code above.