Potencial VBul MySQL injection?

[j0rd]

I got this database error emailed to me today.

Database error in vBulletin 3.6.5:

Invalid SQL:

SELECT user.avatarid, user.avatarrevision, avatarpath, NOT ISNULL(customavatar.userid) AS hascustom, customavatar.dateline,
customavatar.width, customavatar.height
FROM user AS user
LEFT JOIN avatar AS avatar ON avatar.avatarid = user.avatarid
LEFT JOIN customavatar AS customavatar ON customavatar.userid = user.userid
WHERE user.userid = cc;

MySQL Error : Unknown column 'cc' in 'where clause'
Error Number : 1054
Date : Monday, May 14th 2007 @ 10:13:45 PM
Script : http://fnk.ca/board/private.php?s=&pp=&folderid=-1
Referrer : http://fnk.ca/board/private.php?s=&pp=&folderid=-1
IP Address : 74.98.103.xxx
Username : F*r*a*
Classname : vb_database

Tracked the code down. It's in this file: includes/functions_user.php

The code in question is:

PHP Code:

function fetch_avatar_url($userid)
{
   global $vbulletin;

   if ($avatarinfo = $vbulletin->db->query_first_slave("
      SELECT user.avatarid, user.avatarrevision, avatarpath, NOT ISNULL(customav
         customavatar.width, customavatar.height
      FROM " . TABLE_PREFIX . "user AS user
      LEFT JOIN " . TABLE_PREFIX . "avatar AS avatar ON avatar.avatarid = user.a
      LEFT JOIN " . TABLE_PREFIX . "customavatar AS customavatar ON customavatar
      WHERE user.userid = $userid")) 


Which i then changed to:

PHP Code:

function fetch_avatar_url($userid)
{
   global $vbulletin;

   // Scrub the userid 
   $userid = intval($userid);

   if ($avatarinfo = $vbulletin->db->query_first_slave("
      SELECT user.avatarid, user.avatarrevision, avatarpath, NOT ISNULL(customav
         customavatar.width, customavatar.height
      FROM " . TABLE_PREFIX . "user AS user
      LEFT JOIN " . TABLE_PREFIX . "avatar AS avatar ON avatar.avatarid = user.a
      LEFT JOIN " . TABLE_PREFIX . "customavatar AS customavatar ON customavatar
      WHERE user.userid = $userid")) 


Not sure what code is calling it with the bad error, but i don't really care, the field should be scrubbed anyways before it's passed to the query.


Please comment

[Zero Tolerance]

Users have no way to change the $userid variable passed into the function (as far as I'm aware), the only real exploit really is if someone made an addon where users could, or forcefully tried to exploit that function.

But, for stock vBulletin, it's perfectly safe

- Zero Tolerance