vBulletin remote admin injection exploit

!/usr/bin/perl Title: vBulletin remote admin injection exploit Author: Simo Ben youssef Contact: SimoatMorxploitcom Coded: 17 September 2013 Published: 24 October 2013 MorXploit Research http://www.MorXploit.com Vendor: vBulletin www.vbulletin.com Version: 4.1.x / 5.x.x Vulnerability: Remote admi...

vBulletin index.php/ajax/api/reputation/vote nodeid Parameter SQL Injection

This module exploits a SQL injection vulnerability found in vBulletin 5 that has been used in the wild since March 2013. This module uses the sqli to extract the web application's usernames and hashes. With the retrieved information tries to log into the admin control panel in order to deploy the...

vBulletin Password Collector via nodeid SQL Injection

This module exploits a SQL injection vulnerability found in vBulletin 5 that has been used in the wild since March 2013. This module can be used to extract the web application's usernames and hashes, which could be used to authenticate into the vBulletin admin control panel. This module requires...

vBulletin 4.1.x RCE

Remote command execution vulnerability in vBulletin upgrade.php Vulnerability Type: Remote Command Execution For the exploit source code contact DSquare Security sales team...

vBulletin 5.x Remote Administrator Injection

Remote administrator injection vulnerability in vBulletin upgrade.php Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...

VBulletin Content Management System Administrator Injection Remote Code Execution

A remote code execution vulnerability has been reported in VBulletin Content Management System. A remote attacker may exploit this issue by sending specially crafted POST message to the target server. Exploitation of this vulnerability may result in remote code execution...

vBulletin vBSEO 3.2.0 / 3.6.0 Cross Site Scripting

Exploit Title : Cross Site Scripting XSS - Stored vulnerability in vBulletin SEO Plugin vBSEO. Found By : Yogesh Jaygadkar | http://www.jaygadkar.com/ Tested versions : vBSEO 3.2.0 & vBSEO 3.6.0 Tested with : vBulletin 4.0.6 & vBulletin 4.2.1 Vulnerable POST Parameter : sendtrackbacks Greetz to :...

vBulletin Zero Day Used to Hack MacRumors, vBulletin

A hacker group calling itself Inj3ct0r is taking responsibility for the compromise of more than 860,000 passwords at MacRumors.com as well as a separate attack on vBulletin.com, makers of the vBulletin software powering a number of high-profile forums including MacRumors and Ubuntu Forums. The...

vBulletin Forum hacked with Zero Day vulnerability, caused Macrumors Forum Data breach

Last Tuesday, Popular Mac news website MacRumors's user forums was hacked and forum database has been compromised including the username, email and passwords belonging to all 860,000 registered users. Yesterday, Inj3ct0r Team of Exploit Database website 1337Day claimed the responsibility for the...

vBulletin Forum hacked with Zero Day vulnerability, caused Macrumors Forum Data breach

None...

vBulletin 4.1.x, 5.x Authentication Bypass Vulnerability - Active Check

vBulletin is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:vbulletin:vbulletin";...

MacRumors Forums Hacked, Passwords Stolen

The hacker behind the MacRumors Forums breach said the attack was “friendly” and that none of the data accessed will be leaked. Editorial Director Arnold Kim confirmed to Threatpost that a post on the forums from the hacker is legitimate. Kim posted an advisory on the forum on Monday informing...

vBulletin upgrade.php Accessible

The vBulletin install hosted on the remote host allows access to the upgrade.php script. The vendor recommends that access to this be disabled as a precaution. Note that the version may be affected by a security bypass vulnerability due to an error in the configuration mechanism. This could allow...

vBulletin 4.1.x / 5.x.x Administrative User Injection

!/usr/bin/perl Title: vBulletin remote admin injection exploit Author: Simo Ben youssef Contact: SimoatMorxploitcom Coded: 17 September 2013 Published: 24 October 2013 MorXploit Research http://www.MorXploit.com Vendor: vBulletin www.vbulletin.com Version: 4.1.x / 5.x.x Vulnerability: Remote admi...

vBulletin管理员帐号注入漏洞

VBulletin是一个强大灵活并可完全根据自己的需要定制的论坛程序套件。 vBulletin 4.x.x及5.x.x允许攻击者利用vBulletin配置机制创建另一个管理员账户，即可具有vBulletin应用的完全控制权，然后控制其所支持的站点。要利用此漏洞，攻击者需要具有vBulletin upgrade.php准确的URL及用户ID 0 VBulletin 5.x VBulletin 4.x 厂商补丁： VBulletin --------- 厂商目前尚未透露该漏洞的根本原因及影响，但是建议用户在vBulleting...

CVE-2013-6129

The install/upgrade.php scripts in vBulletin 4.1 and 5 allow remote attackers to create administrative accounts via the customerid, htmldatapassword, htmldataconfirmpassword, and htmldataemail parameters, as exploited in the wild in October 2013...

Design/Logic Flaw

The install/upgrade.php scripts in vBulletin 4.1 and 5 allow remote attackers to create administrative accounts via the customerid, htmldatapassword, htmldataconfirmpassword, and htmldataemail parameters, as exploited in the wild in October 2013...

CVE-2013-6129

CVE-2013-6129 affects vBulletin 4.1 and 5. The install/upgrade.php component allows remote attackers to create administrative accounts by submitting crafted POST fields (customerid, htmldata[password], htmldata[confirmpassword], htmldata[email]); this was exploited in the wild in October 2013. Co...

CVE-2013-6129

The install/upgrade.php scripts in vBulletin 4.1 and 5 allow remote attackers to create administrative accounts via the customerid, htmldatapassword, htmldataconfirmpassword, and htmldataemail parameters, as exploited in the wild in October 2013...

VulnCheck KEV: CVE-2013-6129

The install/upgrade.php scripts in vBulletin 4.1 and 5 allow remote attackers to create administrative accounts via the customerid, htmldatapassword, htmldataconfirmpassword, and htmldataemail parameters, as exploited in the wild in October 2013...