Re: Vbulletin 3.7.0 Gold >> Sql injection on faq.php

[martin.meredith@vbulletin.com]

This is invalid. the variable q is taken, split into words, and then each word is escaped for usage within the DB.

Once again, this is invalid

[Matias Blanco]

This exploit is valid. We've just exploted it.

VBulletin 3.7.0 Gold.

martin.meredith@vbulletin.com wrote:
> This is invalid. the variable q is taken, split into words, and then each word is escaped for usage within the DB.
>
> Once again, this is invalid
>