Security flaw found in all vBulletin versions

Reposted at the request of Floren who is banned from here.

Following on from an exploit created by an Iranian Security group, it would appear that all versions of vBulletin are vulnerable, not just the ones listed in the exploit documentation.

Basically, if I'm an administrator (Floren uid 1), the hacker can generate a registered user (Floren uid 3856).

If you allow the Registered Users group to change their user title, the hacker can impersonate any admin and start posting fake announcements, or simply emulate your posting behavior like replying to public threads, etc. The group permissions still apply, so no direct abuse can be inflicted to forum. However, since the impersonator's username is identical to yours, he/she will start receiving your PM's also, gaining privacy control over all data sent to you.

The only fix available is to filter your usernames and allow only alphanumeric characters, when a guest tries to register.
Go to vBulletin Options and select the User Registration Options menu.
Into Username Regular Expression field, enter:
^[a-zA-Z0-9@\._ ]+$

This regular expression will allow new usernames to contain only alphanumeric characters, as well the @, dot, underscore and space symbols. You can add other symbols, if you like. The regex is used to stop a guest registering an username containing the & and # characters. The exploit use those characters to generate a fake username identical to an existing forum member. Unfortunately, that will affect all forums who allow unicode characters into usernames.

I recommend you to apply the fix, as soon as possible.