[vBFreak]

*** Warning, important security hole fix ***

Since there's a sql injection security issue in sessions.php of 4images 1.7.1/1.7.2, V@no from 4images has also made an extra fix for the vBulletin users because they're also affected, even if the code to change on the 4images website seems to be not in the modified sessions.php the hole is in there in another line...

My gallery was affected and got sql injected by some spambots, so I think it's good for you to know that

Find:

  function get_session_id() {
    global $HTTP_GET_VARS, $HTTP_POST_VARS;
    if ($this->session_id = $this->read_cookie_data(COOKIE_PREFIX."sessionhash")) {
      $this->mode = "cookie";
    }
    else {
      if (isset($HTTP_GET_VARS[SESSION_NAME])) {
        $this->session_id = $HTTP_GET_VARS[SESSION_NAME];
      }
      elseif (isset($HTTP_POST_VARS[SESSION_NAME])) {
        $this->session_id = $HTTP_POST_VARS[SESSION_NAME];
      }
      else {
        $this->session_id = false;
      }
    }
  }

Replace it with:

  function get_session_id() {
    global $HTTP_GET_VARS, $HTTP_POST_VARS;
    if ($this->session_id = $this->read_cookie_data(COOKIE_PREFIX."sessionhash")) {
      $this->mode = "cookie";
    }
    else {
      if (isset($HTTP_GET_VARS[SESSION_NAME])) {
        $this->session_id = $HTTP_GET_VARS[SESSION_NAME];
      }
      elseif (isset($HTTP_POST_VARS[SESSION_NAME])) {
        $this->session_id = $HTTP_POST_VARS[SESSION_NAME];
      }
      else {
        $this->session_id = false;
      }
    }
    $this->session_id = preg_replace('/[^a-z0-9]+/i', '', $this->session_id);
  }

The original thread can be found here (my request for a vB fix is on page 2)