Re: Vbulletin 3.6.5 Sql Injection ! [misc.php]

[scott-REMOVE () vbulletin com]

There is no SQL injection being performed on that page, the proof of concept script simple grabs any 32 character 
string from the page, the one in question happens to be a logout hash.

The logout hash is used to mitigate a CSRF.