ثغرة في vBulletin 3.7.3

[FONT=Simplified Arabic Fixed][COLOR=#0000bb]  $cronimage [/COLOR][COLOR=#007700]= [/COLOR][COLOR=#dd0000]'<img src="' [/COLOR][COLOR=#007700]. [/COLOR][COLOR=#0000bb]create_full_url[/COLOR][COLOR=#007700]([/COLOR][COLOR=#dd0000]'cron.php?' [/COLOR][COLOR=#007700]. [/COLOR][COLOR=#0000bb]$vbulletin[/COLOR][COLOR=#007700]->[/COLOR][COLOR=#0000bb]session[/COLOR][COLOR=#007700]->[/COLOR][COLOR=#0000bb]vars[/COLOR][COLOR=#007700][[/COLOR][COLOR=#dd0000]'sessionurl'[/COLOR][COLOR=#007700]] . [/COLOR][COLOR=#dd0000]'rand=' [/COLOR][COLOR=#007700].  [/COLOR][COLOR=#0000bb]vbrand[/COLOR][COLOR=#007700]([/COLOR][COLOR=#0000bb]1[/COLOR][COLOR=#007700], [/COLOR][COLOR=#0000bb]1000000[/COLOR][COLOR=#007700])) . [/COLOR][COLOR=#dd0000]'" alt="" width="1" height="1" border="0" />'[/COLOR][/FONT][COLOR=#007700][FONT=Simplified Arabic Fixed];  [/FONT][/COLOR]

$cronimage = '<img src="' . create_full_url('cron.php?' . $vbulletin->session->vars['sessionurl'] . 'rand=' .  TIMENOW) . '" alt="" width="1" height="1" border="0" />';

return md5(TIMENOW . SCRIPTPATH . SESSION_IDHASH . SESSION_HOST . vbrand(1, 1000000));

return md5(uniqid(microtime(), true));

// #############################################################################
/**
* vBulletin's own random number generator
*
* *param    integer    Minimum desired value
* *param    integer    Maximum desired value
* *param    mixed    Seed for the number generator (if not specified, a new seed will be generated)
*/
function vbrand($min, $max, $seed = -1)
{
    if (!defined('RAND_SEEDED'))
    {
        if ($seed == -1)
        {
            $seed = (double) microtime() * 1000000;
        }
 
        mt_srand($seed);
        define('RAND_SEEDED', true);
    }
 
    return mt_rand($min, $max);
}

// #############################################################################
/**
* vBulletin's own random number generator
*
* *param    integer    Minimum desired value
* *param    integer    Maximum desired value
* *param    mixed    No longer used, was previously seed to the generator
*/
function vbrand($min = 0, $max = 0, $seed = null)
{
    mt_srand(crc32(microtime()));
 
    if ($max AND $max <= mt_getrandmax())
    {
        $number = mt_rand($min, $max);
    }
    else
    {
        $number = mt_rand();
    }
    // reseed so any calls outside this function don't get the second number
    mt_srand();
 
    return $number;
}

<?php
 
define('FILE_VERSION_VBULLETIN', '3.7.3 Patch Level 1');
 
?>