CVE-2004-2695: SQL injection vulnerability in the Authorize.net callback code (subscriptions/authorize.php) in Jelsoft vBu...

Security readout for executives and security teams

This is an old vBulletin issue in the Authorize.net subscription callback. A remote attacker could manipulate an invoice-number field and cause SQL statements to run against the forum database. That can threaten account, subscription, and forum data if a legacy affected installation still exists. Exposure is most likely where legacy vBulletin 3.0 through 3.0.3 is still deployed and the subscriptions/Authorize.net callback code remains reachable. Modern or heavily upgraded deployments are not shown as affected by the supplied sources. Prioritize this if any legacy vBulletin payment or subscription system is still online. The business risk is database compromise through an old public web application path, but urgency depends on whether affected versions remain deployed. Mitigation focus: Inventory any vBulletin 3.0 through 3.0.3 installations.; Check vBulletin/Jelsoft guidance for the fixed release or supported workaround.; Apply vendor-recommended updates or retire the affected legacy instance..

Prepared

Jun 29, 2026, 02:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.