vBulletin Upgrade?

Too many custom modifications have been made to this version. They'd need to be redone.

Also, why fix something that isn't broke?

 

Because there are more mods available and im sure the mods we have can be updated or have been plus more features

 

We don't need extra luxuries, we can function perfectly without them.

I'd prefer to continue with our system at the moment as there are minimal problems with it, rather then upgrade and change our routine.

 

yeah thats true but i would like to see some change maybe we could get rid of the bugs in the new sythe skin or a new banner?

 

I'll see what I can do about the skin and banner, but as for a whole forum software update, I think we can give it a miss.

 

Agreed i just want to see some change here its always the same.

 

Change is for the better. Just because an old forum software still works doesn't mean there shouldn't ever been an update. The only excuse I see here is the staff being lazy to move everything over and get new modifications.

Anyway, can you please PM me your MSN? You still owe me some money from a long time ago.

 

You can't say 3.6.4 isn't broken. All it takes is one pissed off mod to exploit it and mess up the forum for a while...

 

3 6 4 is so old that you can get it free and put it on your websites.

stick with the times. the newer versions offer amazing updates and their formatting are so much easier to use.

 

I think we should get a new skin at least. Maybe one that utilizes a S logo with a globe.

 

To SwiftSeller:
Wrong,
The only "free" versions you can get are nullified products, and if used, will cause your site to get shut down.
The only free version of vBulletin was vBulletin Lite.

Also,
Ryan,
When you upgrade the vBulletin you don't lose the mods, as long as your careful enough to save the files then it shouldn't be any problem at all.

To Deathbal Sam:
Naw, you can still get modifications that MIGHT work with vBulletin 3.6.4, they aren't "Supported" or "Updated" as they are with newer versions.

I honestly think it would be for everyone's best interest to upgrade.

 

Don't try and fix something that isn't broken.

 

It's not up to the staff, it's up to Sythe. As far as laziness, we wouldn't need to do anything for a change to happen anyway.

No, you can't.

Indeed.

 

Lol, my bad, I just skimmed the posts before I posted earlier and didn't notice you said the exact same thing as I did.

 

The site is fine. As Ryan said, you dont need to fix something thats not broken.

 

It's fine, but it could be better. Everything is fine right now in the world. It doesn't mean we shouldn't progress.

 

It needs to be updated... OR you know we could just inject SQL all day lol....

vBulletin <= 3.6.4 inlinemod.php "postids" sql injection / privilege
escalation by session hijacking exploit

Code:

vulnerable code in inlinemod.php near lines 185-209:

...
    case 'docopyposts':

        $vbulletin->input->clean_array_gpc('p', array(
            'postids' => TYPE_STR,
        ));

        $postids = explode(',', $vbulletin->GPC['postids']);
        foreach ($postids AS $index => $postid)
        {
            if ($postids["$index"] != intval($postid))
            {
                unset($postids["$index"]);
            }
        }

        if (empty($postids))
        {
            eval(standard_error(fetch_error('no_applicable_posts_selected')));
        }

        if (count($postids) > $postlimit)
        {
            eval(standard_error(fetch_error('you_are_limited_to_working_with_x_posts', $postlimit)));
        }
        break;
...
when an element of $postids array is not an integer, it fails to unset() the proper value.


the result is sql injection near lines 3792-3800:

...
    $posts = $db->query_read_slave("
        SELECT post.postid, post.threadid, post.visible, post.title, post.username, post.dateline, post.parentid, post.userid,
            thread.forumid, thread.title AS thread_title, thread.postuserid, thread.visible AS thread_visible, thread.firstpostid,
            thread.sticky, thread.open, thread.iconid
        FROM " . TABLE_PREFIX . "post AS post
        LEFT JOIN " . TABLE_PREFIX . "thread AS thread USING (threadid)
        WHERE postid IN (" . implode(',', $postids) . ")
        ORDER BY post.dateline
    ");
...

this exploit extract various session hashes from the database
to authenticate as admin and to change the privileges of a registered user
I could not find a way to see results inside html, so this asks true/false
questions to the database, copying posts around threads

possible patch, replace:
foreach ($postids AS $index => $postid)
        {
               if ($postids["$index"] != intval($postid))
            {
                unset($postids["$index"]);
            }
        }

with:

foreach ($postids AS $index => $postid)
        {
           $postids["$index"]=(int)$postids["$index"];
        }


and, some line before:

foreach ($threadids AS $index => $threadid)
        {
            if ($threadids["$index"] != intval($threadid))
            {
                unset($threadids["$index"]);
            }
        }

with:

foreach ($threadids AS $index => $threadid)
        {
           $threadids["$index"]=(int)$threadids["$index"];
        }

You see 3.6.4 has its issues lol.

User banned for infractions can post and custom title 'banned' stuck after infractions expiration. Compatibility problems with IE...

I say Upgrade

 

Great point. Adding it to first post.

 

Wrong. The banned and temporarily banned titles stay on until you post a few times with any browser. It's not a vBulletin thing, it's a cookie/cache thing.