We believe the following should be enough to patch a 3.8.6 board that's vulnerable to the faq.php exploit that a buddy of ours found today and made aware to vBulletin.com
Installation instructions.
Since all you need to do is hook into vBulletin via global.php and delete the phrase from the language, the following should be enough:
Put it in wtn_386_patch.php
Upload to forum directory
Run from browser
Remove from forum directory
And test if you're still vulnerable.
wtn_386_patch.php
PHP Code:
<?php // wtn_386_patch.php
error_reporting(E_ALL & ~E_NOTICE & ~8192);
require_once('./global.php');
$db->query_write("DELETE from " . TABLE_PREFIX . "phrase WHERE varname = 'database_ingo'");
echo "Done";
?>
Please note that we're still testing, rebuilding languages might be required, but I don't believe that's needed.
If rebuild is required, perhaps add
require_once(DIR . '/includes/adminfunctions.php');
after require global
and then before echo on a new line
build_options();
build_language(0);
build_language_datastore();
But I haven't had time to test that yet. I got flaky internet tonight and am preparing dinner
