Bug vBulletin - DBTech vBDonate SQLi 0day

[John MacKinnon]

Not sure if you guys are aware of this vulnerability:

The vulnerability exists within - /dbtech/vbdonate/actions/dodonate.php

The vulnerability exists due to multi-escaping.

Line 1: $dbt_vbd_donate_params = explode('|', $db->escape_string($vbulletin->GPC['amount']));Line 2: $dbt_vbd_donate_amount = $vbulletin->GPC['amount'];  Line 3: " . $db->escape_string($dbt_vbd_donate_amount) . ",

Exploit POC

http://site.com/vbdonate.php?do=dodonate
POST amount=5.00[SQL]

Example:
http://puu.sh/17C6f

 

[Fillip H.]

This does not exist in v1.3.0 of the files.

However, it was an issue in v1.2.1, but has been fixed in v1.2.2 and v1.3.0