Description
vBulletin是美国InternetBrands和vBulletinSolutions公司的一款基于PHP和MySQL的开源Web论坛程序。 vBulletin 5.5.4版本至5.6.2版本中存在安全漏洞。攻击者可借助带有特制subWidgets数据的ajax/render/widget_tabbedcontainer_tab_panel请求利用该漏洞执行命令。
vBulletin 注入漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://avd.aliyun.com/product?prod=vbulletin
https://blog.nsfocus.net/tag/vbulletin%E6%BC%8F%E6%B4%9E/
https://wlzx.cug.edu.cn/info/1072/1984.htm
https://stack.chaitin.com/vuldb/detail/3fc9a7bd-54ea-4a94-805d-05d9cae4b35c
https://forum.90sec.com/t/topic/1024
https://nosec.org/m/share/3022.html
https://qkl.seebug.org/vuldb/ssvid-92354
https://www.ithome.com.tw/news/169300
https://www.dptech.com/index.php?m=content&c=index&a=show&catid=75&id=1312
https://bbs.kanxue.com/thread-196449.htm
https://www.cnblogs.com/AtesetEnginner/p/11662507.html
https://www.sentinelone.com/blog/vbulletin-cve-2023-25135/
https://github.com/Sachinart/vbulletin-rce
https://www.wangsu.com/news/content/blog/3617
https://www.invicti.com/web-application-vulnerabilities/vbulletin-php-object-injection-vulnerability
https://www.juniper.net/us/en/threatlabs/ips-signatures/detail.HTTP:PHP:VBULLETIN-PHP-OBJ-INJ.html
https://app.opencve.io/cve/?vendor=vbulletin&product=vbulletin&page=1
https://pentest-tools.com/vulnerabilities-exploits/vbulletin-423-sql-injection_3420
https://www.acunetix.com/vulnerabilities/web/vbulletin-4-up-to-4-1-2-search-php-sql-injection/
https://blog.sucuri.net/2014/07/sql-injection-on-vbulletin-5-x.html
https://www.networkworld.com/article/681082/byod-hackers-exploit-vbulletin-vulnerability-to-inject-rogue-administrator-accounts.html
https://www.exploit-db.com/exploits/32017
https://nvd.nist.gov/vuln/detail/CVE-2016-6195
https://karmainsecurity.com/KIS-2019-01
https://www.vbulletin.com/forum/project.php?issueid=21615
https://www.cnvd.org.cn/flaw/show/CNVD-2013-00028