vBulletin '/install/upgrade.php' Security Bypass Vulnerability

Bugtraq ID:	62909
Class:	Access Validation Error
CVE:	CVE-2013-6129
Remote:	Yes
Local:	No
Published:	Aug 13 2013 12:00AM
Updated:	Nov 01 2013 01:11AM
Credit:	Joshua Rogers
Vulnerable:	VBulletin VBulletin 4.1.12 VBulletin VBulletin 4.1.10 VBulletin VBulletin 4.1.7 VBulletin VBulletin 4.1.5 VBulletin VBulletin 4.1.4 VBulletin VBulletin 4.1.5 PL1 VBulletin VBulletin 4.1.4 PL3 VBulletin VBulletin 4.1.3 PL3 VBulletin VBulletin 4.1.3 PL1 VBulletin VBulletin 4.1.3 VBulletin VBulletin 4.1.2 PL1 VBulletin VBulletin 4.1.11 VBulletin VBulletin 4.1.1 PL1 VBulletin VBulletin 4.1.0 PL3
Not Vulnerable:

vBulletin '/install/upgrade.php' Security Bypass Vulnerability

vBulletin is prone to a security-bypass vulnerability.

Successful exploits can allow attackers to bypass certain security restrictions and perform unauthorized actions.

vBulletin '/install/upgrade.php' Security Bypass Vulnerability

This issue is being exploited in the wild.

The following exploit is available:

• /data/vulnerabilities/exploits/62909.pl

vBulletin '/install/upgrade.php' Security Bypass Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

vBulletin '/install/upgrade.php' Security Bypass Vulnerability

References:

• vBulletin Homepage (vBulletin)