Quote:With a huge string of vBulletin sites being hacked, there is no doubt that a Zero-Day is floating around. The Zero-Day was released publicly on a popular Hacking forum and was posted along with a tutorial on how to exploit a targeted site

More: http://zerosecurity.org/security/vbullet...y-released

Hardly a 0day, VBulletin tells its users to delete the install directory.

Mhm, that's right. It's pretty stupid not to delete the install folder/directory. Administrator's fault, nothing to do with vBulletin.

I had this way before. It's a real shame someone leaked it.

(09-09-2013, 02:51 AM)Oni Wrote: I had this way before. It's a real shame someone leaked it.

Well, it's not really a 0day, :3. Also, I would have thought most administrators followed the instructions, when deleting the install directory, so I never thought to look.

(09-09-2013, 02:58 AM)Ultimatum Wrote: Well, it's not really a 0day, :3. Also, I would have thought most administrators followed the instructions, when deleting the install directory, so I never thought to look.

Well, not anymore it isn't. Haha.

Hard to say it's a 0day, but whatever :d
It should be actually obvious to delete the insstallation files :/

(09-09-2013, 02:43 PM)CamIce Wrote: Hard to say it's a 0day, but whatever :d
It should be actually obvious to delete the insstallation files :/

No, it was. Reason being, a large portion of people leave the upgrade system there. Notice how vBulletin instructed customers only to delete the upgrade files? What would have normally been perfectly safe has become exploitable, and mainly due to poor practice on their end.

While I certainly remove installation files, a lot of people don't. MyBB, for example, has a lock on the installation files. It is also worth noting that vBulletin has left the files there on their own forum (with authentication). I might release a modified script that I have later. You'll see how dangerous it is.

(09-09-2013, 02:56 PM)Oni Wrote: No, it was. Reason being, a large portion of people leave the upgrade system there. Notice how vBulletin instructed customers only to delete the upgrade files? What would have normally been perfectly safe has become exploitable, and mainly due to poor practice on their end.

While I certainly remove installation files, a lot of people don't. MyBB, for example, has a lock on the installation files. It is also worth noting that vBulletin has left the files there on their own forum (with authentication). I might release a modified script that I have later. You'll see how dangerous it is.

Yes, only error on the administartor's part, not vBulletin, there is no actual vulnerability in the code, it's just silly error, like leaving a .sql backup, named "backup.sql" on the index. This is basically all booter skiddies.

(09-10-2013, 04:48 AM)Ultimatum Wrote: Yes, only error on the administartor's part, not vBulletin, there is no actual vulnerability in the code, it's just silly error, like leaving a .sql backup, named "backup.sql" on the index. This is basically all booter skiddies.

It's considered a vulnerability. Unless you disagree with me and the developers of vBulletin, of course.

Read: http://www.vbulletin.org/forum/showthrea...ost2441494