vBulletin admincp/admincalendar.php模块SQL注入漏洞

BUGTRAQ ID: 32348 vBulletin是一款开放源代码的PHP论坛程序。 vBulletin论坛的admincp/admincalendar.php文件没有正确地验证用户提交参数： -------------------original source code------------------ if$POST'do' == 'saveholiday' $vbulletin-input-cleanarraygpc'p', array 'holidayid' = TYPEINT, 'holidayinfo' = TYPEARRAY, 'month1' = TYPEINT,...