vulnerable code in inlinemod.php near lines 185-209:

...
    case 'docopyposts':

        $vbulletin->input->clean_array_gpc('p', array(
            'postids' => TYPE_STR,
        ));

        $postids = explode(',', $vbulletin->GPC['postids']);
        foreach ($postids AS $index => $postid)
        {
            if ($postids["$index"] != intval($postid))
            {
                unset($postids["$index"]);
            }
        }

        if (empty($postids))
        {
            eval(standard_error(fetch_error('no_applicable_posts_selected')));
        }

        if (count($postids) > $postlimit)
        {
            eval(standard_error(fetch_error('you_are_limited_to_working_with_x_posts', $postlimit)));
        }
        break;
...
when an element of $postids array is not an integer, it fails to unset() the proper value.


the result is sql injection near lines 3792-3800:

...
    $posts = $db->query_read_slave("
        SELECT post.postid, post.threadid, post.visible, post.title, post.username, post.dateline, post.parentid, post.userid,
            thread.forumid, thread.title AS thread_title, thread.postuserid, thread.visible AS thread_visible, thread.firstpostid,
            thread.sticky, thread.open, thread.iconid
        FROM " . TABLE_PREFIX . "post AS post
        LEFT JOIN " . TABLE_PREFIX . "thread AS thread USING (threadid)
        WHERE postid IN (" . implode(',', $postids) . ")
        ORDER BY post.dateline
    ");
...

this exploit extract various session hashes from the database
to authenticate as admin and to change the privileges of a registered user
I could not find a way to see results inside html, so this asks true/false
questions to the database, copying posts around threads

possible patch, replace:
foreach ($postids AS $index => $postid)
        {
               if ($postids["$index"] != intval($postid))
            {
                unset($postids["$index"]);
            }
        }

with:

foreach ($postids AS $index => $postid)
        {
           $postids["$index"]=(int)$postids["$index"];
        }


and, some line before:

foreach ($threadids AS $index => $threadid)
        {
            if ($threadids["$index"] != intval($threadid))
            {
                unset($threadids["$index"]);
            }
        }

with:

foreach ($threadids AS $index => $threadid)
        {
           $threadids["$index"]=(int)$threadids["$index"];
        }