vB 4.1.4 - Vulnerable to SQL Injection?

[ozzy47]

Well the main thing I can think of you may have issues with the navigation. Pre 4.2.0 did not use the Navigation Manager.

[Lynne]

Set up a test site and do an upgrade there first. Then you can modify your style, export it, and import it to the live site when you do the upgrade.

[thetechgenius]

Originally Posted by ozzy47

Well the main thing I can think of you may have issues with the navigation. Pre 4.2.0 did not use the Navigation Manager.

Your right. I have all my Nav Tabs coded manually in the navbar template. So when I do upgrade, I probably wont use the Navigation Manager, and just code my Nav Tabs in the navbar template. So I don't run into any issues in the long run, I think if I do it that way, it will be less of a hassle.

What do you guys/girls think?

You have to remember, it took a lot of time, money and A LOT of patience to get my forum exactly the way I want it. I custom coded a lot of the features on my forum, including a lot of the Profile, the entire Postbit Legacy, the user info bar at the top, the sticky user info bar at the top that scrolls with the page, a modified Login Menu, the javascript loading bar at the top that loads with the page, a custom ShortURL System (with another Top Level Domain), a custom coded Anonymous URL System (an updated version from the one I posted on vb.org), and MUCH MUCH more. lol

Like I said, it took a long time, a lot of work, and a lot of patience, to get my forum exactly the way I want it, without errors.

[ozzy47]

It will take some work, but you are better off in the long run. Cause all the work you have done so far is no good if someone keeps hacking the site, because you did not upgrade.

[kh99]

I don't remember what changes were in what version, but I know that there were some template changes made where I believe they got rid of some of the 'bit' templates and instead used a vb:each loop in the main template. But if you do as Lynne suggested then you'll see where you stand before committing to anything.

[ozzy47]

Yeah there were a few minor tweaks hear and there. But it should not be overly difficult to sort.

[Paul M]

There is at least 1 known [recent] SQL Injection in 4.1.4 (it affects all 4.x.x versions as I recall), I vaguely recall at least 1 other as well.

Its quite an old version now, and several recent patches do not go back that far.

[ozzy47]

Yeah Paul, that is what I am saying. It's time to bite the bullet and do a upgrade, especially since he is on someones radar.

[thetechgenius]

I agree. I will do as Lynne suggested and install a backup of my forum on a Sub-Domain, and Password Protect the directory since its only for testing purposes. This way I can upgrade to the latest version of vB to see what I need to change in the style, without it affecting my Live Board if anything goes wrong.

Thank You Paul, Ozzy, Lynne and everyone else!! Its greatly appreciated!

[ozzy47]

Not a problem, let us know how it goes.