vBulletin 4.X Security Patch

[vB.Org System]

vBulletin Publishing suite

• 4.1.2 PL1
• 4.1.1 PL1
• 4.1.0 PL3
• 4.0.8 PL3
• 4.0.7 PL1
• 4.0.6 PL1
• 4.0.5 PL1
• 4.0.4 PL2
• 4.0.3 PL2
• 4.0.2 PL5
• 4.0.1 PL1
• 4.0.0 PL2

vBulletin Forum classic

• 4.1.2 PL1
• 4.1.1 PL1
• 4.1.0 PL3
• 4.0.8 PL3
• 4.0.7 PL1
• 4.0.6 PL2
• 4.0.5 PL1
• 4.0.4 PL2
• 4.0.3 PL2
• 4.0.2 PL5
• 4.0.1 PL1
• 4.0.0 PL2

Has been released.

A flaw within a side query that is used in the search UI has recently been discovered. This flaw may enable malicious individuals to inject sql that would allow you to run arbitrary queries on the db via this exploit. To resolve this issue, it has been necessary to release a patch level version on all versions of vBulletin 4.X. The issue does not affect vBulletin 3.X to the best of our knowledge. We are not aware of a website that has been compromised by this flaw.

The upgrade process is the same as previous patch level releases - simply download the patch from the Members Area, extract the files and upload to your webserver, overwriting the existing files. There is no upgrade script required.

As with all security-based releases, we recommend that all customers upgrade as soon as possible in order to prevent any potential damage resulting from the flaw being exploited.


Upgrading from 4.X

If you are already running 4.X, the process you will be required to follow to make your board immune to this flaw is very simple.

Visit the Patches section of the vBulletin Members' Area and download the patch for the version you are using, then extract the files from the archive you downloaded, then upload the files to your board via FTP etc., overwriting the existing files. This will update your version to the PL1 release.

Why have we patched every version of 4.X?
Yes eagle eyed viewers it is different to what vBulletin has done previously. In order to improve our customer experience, and requiring that you upgrade to the latest version of vBulletin (and potentially purchase the latest version of vBulletin to do that) we have released a patch for all versions that are affected.
Likewise, all download versions of 4.X have been updated.


More...