Re: Vbulletin 3.7.0 Gold >> Sql injection on faq.php

[Matias Blanco <blue () corest com>]

This exploit is valid. We've just exploted it.

VBulletin 3.7.0 Gold.

martin.meredith () vbulletin com wrote:
> This is invalid. the variable q is taken, split into words, and then each word is escaped for usage within the DB. 
>
> Once again, this is invalid
>