Getting Database Error Mails Despite of Applying Patch

Hi,

Today my forum members reported unusual issues happening (Database Errors, Red Links etc.) which I later found to be the symptoms of recently found loophole in vBSEO. I immediately applied the patch (Fixing functions_vbseocp_abstract.php) and the problem was apparently solved. Sometime later on, I observed that my mailbox was filled with thousands of vBulletin Database Error Mails but forum was still working fine. Now after sometime I’m still receiving those Database Error Mails intermittently.

Does it indicate that there is still some issue in my forum due to vBSEO loophole? Please suggest as I’m quite afraid. Here is a sample of Database Error Mail which I’m getting:

Database error in vBulletin 3.8:

Invalid SQL:
SELECT * FROM datastore WHERE title='pluginlist';

MySQL Error :
Error Number :
Request Date : Wednesday, January 25th 2012 @ 05:19:56 AM
Error Date : Wednesday, January 25th 2012 @ 05:19:56 AM
Script : {Link Removed}
Referrer : {Link Removed}
IP Address : {IP Removed}
Username : Unregistered
Classname : vB_Database
MySQL Version :

PS: I also tested the plugins using testing utility and result was OK.

What is the referring page?

Each mail has different links to certain various locations of forums.

Try re-importing the vbseo product file as a first troubleshooting step.

Just did that. Hope it works. I will update in sometime.

Unfortunately this didn't work. All of sudden again I just received a bunch of similar database error mails. Now what? (The referrer is both, from Google as well as my forum).

Please open a ticket with login details for further troubleshooting.

Done. Thanks.

Hello,

please try vbseo_checkplugins2.zip script from this post: *vBSEO Security Bulletin* All Supported Versions: Patch Release and if you will get warning regarding datastore pluginlist, click "reset datastore" link.

I would also recommend having everyone check for oddly named .dat files in their forum root folder for example:

Code:

zdberr12579f3d448c623d3c064d5ee9116eb1.dat

I've noticed on sites that have had a plugin added also had a .dat file added as well, to confirm I checked backups and sure enough the file was never there before, just a suggestion.

Hi Michael,

can you share the contents of the dat file?

These files are created by vBulletin (when there are many db error in a short time period to avoid mail flooding).

Originally Posted by Brian Cummiskey

Hi Michael,

can you share the contents of the dat file?

Originally Posted by Oleg Ignatiuk

These files are created by vBulletin (when there are many db error in a short time period to avoid mail flooding).

Well the thing is... my site is on a VPS, it's hosted at URLJet and I also do part time work there... I have back-end access to everything and there were not any such errors taking place nor could I figure out why it was generated based on the fact I rarely receive a database error without looking into it and there have only been three within the past month that were misc and not anything to worry about... why was this file generated if there are no errors occuring?

I also noticed this on every *nearly every* single site I have had to sort out due to the recent issues so that's why I thought to mention and the contents when renaming from .dat to .php were:

13274237412006

https://www.vbulletin.com/forum/show...t-a-weird-file

The PHP code that generates the file also deals with cookies reference the code so I feel there's still more to this story than we know at the moment - have a look at Wayne's reply where he quotes the code, now the file was associated with this plugin:



I found that on my company site the day of the announcement, hopefully now you can understand why my recent reply to the thread was so rude, I was quite livid at the moment respectively.

The file is created by vBulletin's class_core.php file (you can find the code quoted in https://www.vbulletin.com/forum/show...=1#post2234449 in that file).

The plugin on screenshot is one of rogue plugins that is detected by our scanner script and it should be definitely removed.

Originally Posted by Oleg Ignatiuk

The file is created by vBulletin's class_core.php file (you can find the code quoted in https://www.vbulletin.com/forum/show...=1#post2234449 in that file).

The plugin on screenshot is one of rogue plugins that is detected by our scanner script and it should be definitely removed.

Well for pete's sake I know that Oleg .

I'm trying to point out that they might have been using the file generated for another purpose or in fact generating it for whatever purpose I'm not sure though but again thought it would be worth mentioning because there were no errors in my file only a random string of numbers shown above and the file appeared at the same time the plugin did within my admincp so I just feel like something is up with it honestly.