(09-09-2013, 02:43 PM)CamIce Wrote: Hard to say it's a 0day, but whatever :d
It should be actually obvious to delete the insstallation files :/

No, it was. Reason being, a large portion of people leave the upgrade system there. Notice how vBulletin instructed customers only to delete the upgrade files? What would have normally been perfectly safe has become exploitable, and mainly due to poor practice on their end.

While I certainly remove installation files, a lot of people don't. MyBB, for example, has a lock on the installation files. It is also worth noting that vBulletin has left the files there on their own forum (with authentication). I might release a modified script that I have later. You'll see how dangerous it is.