vbulletin5-rce

vbulletin5 rce 취약점 탐지 도구 0x00 개요 2019년 9월, vbulletion55.0.0-5.5.4에서 rce 취약점CVE-2019-16759이 공개되었으며, ajax/render/widgetphp 파일과 post 매개변수 widgetConfigcode를 사용하여 직접 원격 코드 실행이 가능합니다. 2020년 8월 11일, 인터넷에 CVE-2019-16759 패치가 우회될 수 있다는 소식이 퍼졌으며, ajax/render/widgettabbedcontainertabpanel을 사용하고 post 매개변수...

vbull

vBulletin 대량 익스플로잇 CVE-2019-16759 경고! 이 도구는 CVE-2019-16759에 대한 침투 테스트를 위해 만들어졌습니다. 사용자가 이 도구를 사용하여 발생하는 오류에 대해 책임을 지지 않습니다. 설치 및 사용법: $ pkg install git python2 $ pip2 install requests $ git clone https://github.com/psychoxploit/vbull $ cd vbull 참고: 이 도구를 실행하기 전에 http://target.tld/ 또는...

pwn-vbulletin

Mass-Pwn-vBulletin Shodan을 사용하여 취약한 RCE vBulletin 5.0.0 - 5.5.4 인스턴스 식별 CVE-2019-16759 Bulletin Demo 요구 사항: Python = 3.5.3 asyncio = 3.4.3 aiohttp = 3.6.1 ipaddress termcolor = 1.1.0 tqdm = 4.36 pyfiglet click = 7.0 IPy = 1.0 호스트 수집: 이 도구는 포트 443 및 80에서 vBulletin 호스트를 비동기적으로 순회하며 CVE-2019-16759에...

vBulletin_Routestring-RCE

CVE-2019-16759vBulletinRoutestring-RCE-PoC vBulletin에서 악의적인 POST 요청이 취약한 애플리케이션에 전송될 때 원격 코드 실행을 허용할 수 있는 취약점이 발견되었습니다. 이 취약점은 취약한 모듈에서 HTTP 요청을 구문 분석하는 동안 발생하는 입력 검증 오류로 인해 발생합니다. 영향받는 시스템 : vBulletin 버전 5.0.0 5.5.4 업데이트된 영향 시스템 vBulletin 버전 5.0.0 5.6.2 사용법 python vBulletinRoutestring-RCE.py Use...

CVE-2019-16759-bypass

CVE-2019-16759-bypass...

CVE-2019-16759-Vbulletin-rce-exploit

이 저장소에는 README가 없습니다...

http-vuln-CVE-2019-16759

SUMMARY vBulletin 5.x 0day 사전 인증 RCE를 탐지하는 간단한 NSE 스크립트입니다. 5.0.0부터 5.5.4까지 모든 버전에서 작동합니다. INSTALLATION $ git clone https://github.com/r00tpgp/http-vuln-CVE-2019-16759 $ cd http-vuln-CVE-2019-16759/ $ sudo cp http-vuln-CVE-2019-16759.nse /usr/share/nmap/scripts/ USAGE $ sudo nmap --script...

vBulletin 5.0.0-5.5.4 - Remote Command Execution

vBulletin 5.0.0 through 5.5.4 is susceptible to a remote command execution vulnerability via the widgetConfig parameter in an ajax/render/widgetphp routestring request. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system...

CVE-2020-17496

vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widgettabbedcontainertabpanel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759...

CVE-2020-7373

vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widgettabbedcontainertabpanel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759. ALSO NOTE: CVE-2020-7373 is a duplicate of CVE-2020-17496. CVE-2020-17496 is...

CVE-2019-16759

vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfigcode parameter in an ajax/render/widgetphp routestring request...

vBulletin PHP Module Remote Code Execution Vulnerability

The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via crafted subWidgets data in an ajax/render/widgettabbedcontainertabpanel request. This CVE ID resolves an incomplete patch for CVE-2019-16759...

CVE-2020-7373

vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widgettabbedcontainertabpanel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759. ALSO NOTE: CVE-2020-7373 is a duplicate of CVE-2020-17496. CVE-2020-17496 is...

Design/Logic Flaw

vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widgettabbedcontainertabpanel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759. ALSO NOTE: CVE-2020-7373 is a duplicate of CVE-2020-17496. CVE-2020-17496 is...

CVE-2020-7373

vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widgettabbedcontainertabpanel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759. ALSO NOTE: CVE-2020-7373 is a duplicate of CVE-2020-17496. CVE-2020-17496 is...

CVE-2020-7373

Summary (CVE-2020-17496 / CVE-2020-7373): vBulletin 5.5.4–5.6.2 is vulnerable to remote code execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. This issue stems from an incomplete fix of CVE-2019-16759, and CVE-2020-7373 is a duplicate of CVE-2020-17...

CVE-2020-7373

vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widgettabbedcontainertabpanel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759. ALSO NOTE: CVE-2020-7373 is a duplicate of CVE-2020-17496. CVE-2020-17496 is...

Exploit for Code Injection in Vbulletin

CVE-2019-16759vBulletinRoutestring-RCE-PoC A vulnerability...

Exploit for Code Injection in Vbulletin

It is an exploit module for Apache Struts 2. CVE-2019-16759 is t...

vBulletin 5.x Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'vBulletin 5.x /ajax/render/widgettabbedcontainertabpanel PHP remote code execution.', 'Description' = %q This module exploits a logic bug within...