Description
5.5.6pl1之前的vBulletin，5.6.0pl1之前的5.6.0和5.6.1pl1之前的5.6.1具有错误的访问控制。
vBulletin getIndexableContent SQL注入漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.tenable.com/plugins/nessus/136613
https://www.invicti.com/web-application-vulnerabilities/vbulletin-5-6-1-nodeid-sql-injection
https://vulners.com/packetstorm/PACKETSTORM:180699
https://www.rapid7.com/db/modules/exploit/multi/http/vbulletin_getindexablecontent/
https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/auxiliary/gather/vbulletin_getindexablecontent_sqli.md
https://www.tenablecloud.cn/plugins/nessus/136613
https://avd.aliyun.com/detail?id=AVD-2020-12720
https://www.acunetix.com/vulnerabilities/web/vbulletin-5-6-1-nodeid-sql-injection/
https://wlzx.cug.edu.cn/info/1072/1984.htm
https://forum.90sec.com/t/topic/1024
https://sploitus.com/exploit?id=PACKETSTORM:189564