漏洞描述
vBulletin是美国InternetBrands和vBulletinSolutions公司的一款基于PHP和MySQL的开源Web论坛程序。 vBulletin 5.5.4版本至5.6.2版本中存在安全漏洞。攻击者可借助带有特制subWidgets数据的ajax/render/widget_tabbedcontainer_tab_panel请求利用该漏洞执行命令。
vBulletin 注入漏洞
PoC代码
暂无相关漏洞推荐
- CVE-2019-16759: vBulletin v5.0.0-v5.5.4 Remote Command Execution
- POC CVE-2016-6195: vBulletin <= 4.2.3 - SQL Injection
- POC CVE-2018-6200: vBulletin - Open Redirect
- POC CVE-2019-16759: vBulletin 5.0.0-5.5.4 - Remote Command Execution
- POC CVE-2020-12720: vBulletin SQL Injection
- POC CVE-2020-17496: vBulletin 5.5.4 - 5.6.2- Remote Command Execution
- POC CVE-2023-25135: vBulletin <= 5.6.9 - Pre-authentication Remote Code Execution
- POC CVE-2025-48827: vBulletin 5.0.0-6.0.3 - Authentication Bypass
- POC CVE-2025-48828: vBulletin replaceAdTemplate - Remote Code Execution
- POC vbulletin-ajaxreg-sqli: vBulletin 3.x / 4.x AjaxReg - SQL Injection
- POC vbulletin-backdoor: vBulletin Backdoor - Detect
- POC vbulletin-search-sqli: vBulletin `Search.php` - SQL Injection
- vBulletin replaceAdTemplate 存在远程代码执行漏洞（CVE-2025-48828）