RETIRED: vBulletin 'upgrade.php' Remote Code Injection Vulnerability
BID:63380
Info
RETIRED: vBulletin 'upgrade.php' Remote Code Injection Vulnerability
| Bugtraq ID: | 63380 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 24 2013 12:00AM |
| Updated: | Nov 01 2013 12:21AM |
| Credit: | Simo Ben youssef |
| Vulnerable: |
VBulletin VBulletin 4.1.12 VBulletin VBulletin 4.1.10 VBulletin VBulletin 4.1.7 VBulletin VBulletin 4.1.5 VBulletin VBulletin 4.1.4 VBulletin VBulletin 4.0.2 VBulletin VBulletin 4.0.1 VBulletin VBulletin 4.0 PL 1 VBulletin VBulletin 4.1.5 PL1 VBulletin VBulletin 4.1.4 PL3 VBulletin VBulletin 4.1.3 PL3 VBulletin VBulletin 4.1.3 PL1 VBulletin VBulletin 4.1.3 VBulletin VBulletin 4.1.2 PL1 VBulletin VBulletin 4.1.11 VBulletin VBulletin 4.1.1 PL1 VBulletin VBulletin 4.1.0 PL3 VBulletin VBulletin 4.0.8 PL3 VBulletin VBulletin 4.0.8 VBulletin VBulletin 4.0.7 PL1 VBulletin VBulletin 4.0.6 PL1 VBulletin VBulletin 4.0.5 PL1 VBulletin VBulletin 4.0.4 PL2 VBulletin VBulletin 4.0.3 PL2 VBulletin VBulletin 4.0.2 PL5 VBulletin VBulletin 4.0.2 PL 4 VBulletin VBulletin 4.0.2 PL 3 VBulletin VBulletin 4.0.2 PL 2 VBulletin VBulletin 4.0.1 PL1 VBulletin VBulletin 4.0.0 PL2 |
| Not Vulnerable: | |
Discussion
RETIRED: vBulletin 'upgrade.php' Remote Code Injection Vulnerability
vBulletin is prone to a remote code-injection vulnerability because it fails to properly sanitize user-supplied input.
An attacker can exploit this vulnerability to inject and execute arbitrary code within the context of the affected application.
Note: This BID is being retired as a duplicate of the issue discussed in BID 62909 (vBulletin '/install/upgrade.php' Security Bypass Vulnerability)
vBulletin is prone to a remote code-injection vulnerability because it fails to properly sanitize user-supplied input.
An attacker can exploit this vulnerability to inject and execute arbitrary code within the context of the affected application.
Note: This BID is being retired as a duplicate of the issue discussed in BID 62909 (vBulletin '/install/upgrade.php' Security Bypass Vulnerability)
Exploit / POC
RETIRED: vBulletin 'upgrade.php' Remote Code Injection Vulnerability
The following exploit is available:
The following exploit is available:
Solution / Fix
RETIRED: vBulletin 'upgrade.php' Remote Code Injection Vulnerability
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
RETIRED: vBulletin 'upgrade.php' Remote Code Injection Vulnerability
References:
References:
- vBulletin Homepage (vBulletin)