Multiple vBulletin Products 'Search UI' SQL Injection Vulnerability
BID:48815
Info
Multiple vBulletin Products 'Search UI' SQL Injection Vulnerability
| Bugtraq ID: | 48815 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 20 2011 12:00AM |
| Updated: | Jul 20 2011 12:00AM |
| Credit: | Altex |
| Vulnerable: |
VBulletin vBulletin Publishing Suite 4.1.2 PL1 VBulletin vBulletin Publishing Suite 4.1.1 PL1 VBulletin vBulletin Publishing Suite 4.1.0 PL3 VBulletin vBulletin Publishing Suite 4.0.8 PL3 VBulletin vBulletin Publishing Suite 4.0.7 PL1 VBulletin vBulletin Publishing Suite 4.0.6 PL1 VBulletin vBulletin Publishing Suite 4.0.5 PL1 VBulletin vBulletin Publishing Suite 4.0.4 PL2 VBulletin vBulletin Publishing Suite 4.0.3 PL2 VBulletin vBulletin Publishing Suite 4.0.2 PL5 VBulletin vBulletin Publishing Suite 4.0.1 PL1 VBulletin vBulletin Publishing Suite 4.0.0 PL2 VBulletin VBulletin 4.0.2 VBulletin VBulletin 4.0.1 VBulletin VBulletin 4.0 PL 1 VBulletin VBulletin 4.1.2 PL1 VBulletin VBulletin 4.1.1 PL1 VBulletin VBulletin 4.1.0 PL3 VBulletin VBulletin 4.0.8 PL3 VBulletin VBulletin 4.0.8 VBulletin VBulletin 4.0.7 PL1 VBulletin VBulletin 4.0.6 PL1 VBulletin VBulletin 4.0.5 PL1 VBulletin VBulletin 4.0.4 PL2 VBulletin VBulletin 4.0.3 PL2 VBulletin VBulletin 4.0.2 PL5 VBulletin VBulletin 4.0.2 PL 4 VBulletin VBulletin 4.0.2 PL 3 VBulletin VBulletin 4.0.2 PL 2 VBulletin VBulletin 4.0.1 PL1 VBulletin VBulletin 4.0.0 PL2 |
| Not Vulnerable: | |
Discussion
Multiple vBulletin Products 'Search UI' SQL Injection Vulnerability
Multiple vBulletin products are prone to an SQL-injection vulnerability because the applications fail to properly sanitize user-supplied input before using it in an SQL query.
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
Multiple vBulletin products are prone to an SQL-injection vulnerability because the applications fail to properly sanitize user-supplied input before using it in an SQL query.
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
Exploit / POC
Multiple vBulletin Products 'Search UI' SQL Injection Vulnerability
Attackers can use a browser to exploit this issue.
Attackers can use a browser to exploit this issue.
Solution / Fix
Multiple vBulletin Products 'Search UI' SQL Injection Vulnerability
Solution:
Updates are available. Please see the references for more details.
Solution:
Updates are available. Please see the references for more details.
References
Multiple vBulletin Products 'Search UI' SQL Injection Vulnerability
References:
References:
- vBulletin Homepage (vBulletin)
- vBulletin 4.X Security Patch (vBulletin )