vBulletin管理员帐号注入漏洞

VBulletin是一个强大灵活并可完全根据自己的需要定制的论坛程序套件。 vBulletin 4.x.x及5.x.x允许攻击者利用vBulletin配置机制创建另一个管理员账户，即可具有vBulletin应用的完全控制权，然后控制其所支持的站点。要利用此漏洞，攻击者需要具有vBulletin upgrade.php准确的URL及用户ID 0 VBulletin 5.x VBulletin 4.x 厂商补丁： VBulletin --------- 厂商目前尚未透露该漏洞的根本原因及影响，但是建议用户在vBulleting...

CVE-2013-6129

The install/upgrade.php scripts in vBulletin 4.1 and 5 allow remote attackers to create administrative accounts via the customerid, htmldatapassword, htmldataconfirmpassword, and htmldataemail parameters, as exploited in the wild in October 2013...

Design/Logic Flaw

The install/upgrade.php scripts in vBulletin 4.1 and 5 allow remote attackers to create administrative accounts via the customerid, htmldatapassword, htmldataconfirmpassword, and htmldataemail parameters, as exploited in the wild in October 2013...

CVE-2013-6129

CVE-2013-6129 affects vBulletin 4.1 and 5. The install/upgrade.php component allows remote attackers to create administrative accounts by submitting crafted POST fields (customerid, htmldata[password], htmldata[confirmpassword], htmldata[email]); this was exploited in the wild in October 2013. Co...

CVE-2013-6129

The install/upgrade.php scripts in vBulletin 4.1 and 5 allow remote attackers to create administrative accounts via the customerid, htmldatapassword, htmldataconfirmpassword, and htmldataemail parameters, as exploited in the wild in October 2013...

VulnCheck KEV: CVE-2013-6129

The install/upgrade.php scripts in vBulletin 4.1 and 5 allow remote attackers to create administrative accounts via the customerid, htmldatapassword, htmldataconfirmpassword, and htmldataemail parameters, as exploited in the wild in October 2013...

vBulletin 4.1.x - installupgrade.php Security Bypass

vBulletin 4.1.x - installupgrade.php Security Bypass source: https://www.securityfocus.com/bid/62909/info vBulletin is prone to a security-bypass vulnerability. Successful exploits can allow attackers to bypass certain security restrictions and perform unauthorized actions. !/usr/bin/perl Title:...

vBulletin 4.1.x - '/install/upgrade.php' Security Bypass

source: https://www.securityfocus.com/bid/62909/info vBulletin is prone to a security-bypass vulnerability. Successful exploits can allow attackers to bypass certain security restrictions and perform unauthorized actions. !/usr/bin/perl Title: vBulletin remote admin injection exploit Author: Simo...

vBulletin Administrator Account Creation

This module abuses the "install/upgrade.php" component on vBulletin 4.1+ and 4.5+ to create a new administrator account, as exploited in the wild on October 2013. This module has been tested successfully on vBulletin 4.1.5 and 4.1.0. Module Options msf use...

Major VBulletin based websites are vulnerable to Hackers; Pakistani forums defaced by Indian Hackers

vBulletin is a publishing suite that allows users to create and publish a variety of content, including: forums, blogs, and polls. If you currently use an older version of vBulletin on your website, you might be opening up your site to an attack as some serious security vulnerabilities, which...

Major VBulletin based websites are vulnerable to Hackers; Pakistani forums defaced by Indian Hackers

vBulletin is a publishing suite that allows users to create and publish a variety of content, including: forums, blogs, and polls. If you currently use an older version of vBulletin on your website, you might be opening up your site to an attack as some serious security vulnerabilities, which...

vbBux / vbPlaza 4.0.3 SQL Injection

Exploit Title: vbBux and vbPlaza v4 SQLI Authors: n3tw0rk twiiter.com/n3tw0rkgod Contact: Mail:[email protected] Product: 4.0.3 and below Software Version x.x.x Product Download: http://www.vbulletin.org/forum/showthread.php?t=270271 Homepage: d4tabase.com The exploit is caused due to a...

vBulletin 4.0.x SQL Injection Vulnerability

vBulletin version 4.0.x appears to suffer from a remote SQL injection vulnerability in the administrative functionality. Exploit Title: vBulletin force Read Thread 0day Authors: n3tw0rk Contact: Mail:email protected Product: 4.0.x Software Version x.x.x Product Download:...

vBulletin 4.0.x SQL Injection

No description provided by source. Exploit Title: vBulletin force Read Thread 0day Authors: n3tw0rk Contact: Mail:[email protected] Product: 4.0.x Software Version x.x.x Product Download: http://www.vbulletin.org/forum/showthread.php?t=241754&page=18 Google Dork: use your mind Homepage:...

vBulletin 4.0.2 - update_order SQL Injection

vBulletin 4.0.2 - updateorder SQL Injection source: https://www.securityfocus.com/bid/61449/info VBulletin is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. A successful exploit may allow an attacker to...

vBulletin 4.0.x SQL Injection

Exploit Title: vBulletin force Read Thread 0day Authors: n3tw0rk Contact: Mail:[email protected] Product: 4.0.x Software Version x.x.x Product Download: http://www.vbulletin.org/forum/showthread.php?t=241754&page=18 Google Dork: use your mind Homepage: d4tabase.com The exploit is caused due...

vBulletin 4.0.2 - 'update_order' SQL Injection

source: https://www.securityfocus.com/bid/61449/info VBulletin is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. A successful exploit may allow an attacker to compromise the application, access or modify data, ...

Ubuntu Forums Password Breach Exposes 1.8 Million Users

Every username, password and email address used by members of the Ubuntu Forums was accessed in a breach reported on Saturday by the free Linux distribution. More than 1.82 million accounts stored in the forums’ database were stolen, according to a notice posted on the forums’ home page Saturday...

vBulletin Advanced User Tagging Mod - Persistent Cross-Site Scripting

vBulletin Advanced User Tagging Mod - Persistent Cross-Site Scripting Exploit Title: Advanced User Tagging vBulletin - Stored XSS Vulnerability Google Dork: intext:usertagpro Date: 10.07.2013 Exploit Author: 0iZy5 Vendor Homepage: www.backtrack-linux.ro Software Link:...

vBulletin Advanced User Tagging Mod - Stored XSS Vulnerability

Exploit for php platform in category web applications Exploit Title: Advanced User Tagging vBulletin - Stored XSS Vulnerability Google Dork: intext:usertagpro Date: 10.07.2013 Exploit Author: 0iZy5 Vendor Homepage: www.backtrack-linux.ro Software Link:...