need help again avatar problem

[kejt]

After cleaning and upgradeing vbulletin, custom avatar will not show. I had to delete image.php because hackers something put in there and vbulltin files dont't have this file.

Can this be the problem?

[Lynne]

Default vbulletin does have a file called image.php. You should go download the whole vb package from the members area on vb.com and put that page back up in your forums.

[kejt]

Sorry I wasted your time, you are right. I put it back and it works fine.

I have question, I read that image.php is prone to an SQL-injection vulnerability,
would it be wise to move option of custom avatar?

Could attack of hackers come from this?

Thanks Lynne

[Lynne]

If you are using the default image.php file (not using any plugins that affect it), then you are fine. It's when you modify it by changing the code or by adding plugins to it that you may cause problems.