Vulnerability CVE-2019-16759


Published: 2019-09-24

Description:
vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.

See advisories in our WLB2 database:
Topic
Author
Date
High
vBulletin 5.x 0-Day Pre-Auth Remote Command Execution
r00tpgp
27.09.2019

Type:

CWE-20

(Improper Input Validation)

Vendor: Vbulletin
Product: Vbulletin 
Version:
5.5.4
5.5.3
5.5.2
5.5.1
5.5.0
5.4.3
5.2.6
5.2.2
5.2.1
5.2.0
5.1.3
5.1.2
5.1.1
5.1.0
5.0.5
5.0.4
5.0.3
5.0.2
5.0.1
5.0.0

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial

 References:
http://packetstormsecurity.com/files/154623/vBulletin-5.x-0-Day-Pre-Auth-Remote-Command-Execution.html
http://packetstormsecurity.com/files/154648/vBulletin-5.x-Pre-Auth-Remote-Code-Execution.html
https://arstechnica.com/information-technology/2019/09/public-exploit-code-spawns-mass-attacks-against-high-severity-vbulletin-bug/
https://seclists.org/fulldisclosure/2019/Sep/31
https://www.theregister.co.uk/2019/09/24/vbulletin_vbug_zeroday/

Related CVE
CVE-2019-17271
vBulletin 5.5.4 allows SQL Injection via the ajax/api/hook/getHookList or ajax/api/widget/getWidgetList where parameter.
CVE-2019-17132
vBulletin through 5.5.4 mishandles custom avatars.
CVE-2019-17131
vBulletin before 5.5.4 allows clickjacking.
CVE-2019-17130
vBulletin through 5.5.4 mishandles external URLs within the /core/vb/vurl.php file and the /core/vb/vurl directories.
CVE-2018-15493
vBulletin 5.4.3 has an Open Redirect.
CVE-2018-6200
vBulletin 3.x.x and 4.2.x through 4.2.5 has an open redirect via the redirector.php url parameter.
CVE-2017-17672
In vBulletin through 5.3.x, there is an unauthenticated deserialization vulnerability that leads to arbitrary file deletion and, under certain circumstances, code execution, because of unsafe usage of PHP's unserialize() in vB_Library_Template's cach...
CVE-2017-17671
vBulletin through 5.3.x on Windows allows remote PHP code execution because a require_once call is reachable with an unauthenticated request that can include directory traversal sequences to specify an arbitrary pathname, and because ../ traversal is...

Copyright 2019, cxsecurity.com

 

Back to Top