PT-2013-15: XML External Entities Injection in vBulletin 5 Connect

The specialists of the Positive Research center have detected an XML External Entities Injection vulnerability in vBulletin 5 Connect. The vulnerability was detected in "appendersocketserver.php" of the Apache log4php library used by vBulletin. PHP's built-in SoapClient class allows the use of...

iCart Pro version 4.0.1 SQL Injection Vulnerability

iCart Pro version 4.0.1 appears to suffer from a remote SQL injection vulnerability. Exploit Title: vbcovor ICART SQLI Date: 25/01/2013 Authors: n3tw0rk Contact: Mail:email protected Product: iCart Pro Software Version 4.0.1 Product Download: http://www.vbcover.com/icart.php?do=product&productid=...

iCart Pro 4.0.1 SQL Injection

Exploit Title: vbcovor ICART SQLI Date: 25/01/2013 Authors: n3tw0rk Contact: Mail:[email protected] Product: iCart Pro Software Version 4.0.1 Product Download: http://www.vbcover.com/icart.php?do=product&productid=61 Google Dork: inurlicart.php Require Editting product access for SQL error...

CVE-2011-5251

Open redirect vulnerability in forum/login.php in vBulletin 4.1.3 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the url parameter in a lostpw action...

Open redirect

Open redirect vulnerability in forum/login.php in vBulletin 4.1.3 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the url parameter in a lostpw action...

CVE-2011-5251

Open redirect vulnerability in forum/login.php in vBulletin 4.1.3 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the url parameter in a lostpw action...

CVE-2011-5251

This CVE concerns an open redirect in vBulletin 4.1.3 and earlier on the login flow (forum/login.php). The flaw allows remote attackers to redirect users to arbitrary sites and facilitate phishing via the url parameter in the lostpw action . Exploitation details in the available sources are limit...

vBulletin 5.0.0 all Beta releases SQL Injection Exploit 0day

This exploit owns any forum based on vBulletin 5. All versions. Still there is no CVE or patch. On this moment vBulletin 5.0.0 beta 21 is the last version and its affected, including the vendor's site. Wow! This is private exploit. You can buy it at https://0day.today...

vBulletin 3. x / 4. x AjaxReg SQL injection and fix-vulnerability warning-the black bar safety net

!/ usr/bin/php ? vBulletin 3. x/4. x AjaxReg remote Blind SQL Injection Exploit https://lh3.googleusercontent.com/-4HcW64E57CI/ULWN9mDnK8I/AAAAAAAAABo/cc0UA9eVak/s640/11-26-2012%25206-02-5s3%2520AM.png livedemo : http://www.youtube.com/watch?v=LlKaYyJxH7E check it :...

vBulletin 5 Multiple Full Path Disclosure vulnerabilities

vBulletin 5.x suffers from multiple FPD's. Where there is a that means ALL FILES! /core/vb5/route/channel.php /core/vb5/route/conversation.php /core/vb5/route/.php /includes/api/interface/noncollapsed.php /includes/api/interface/collapsed.php 0day.today 2018-02-19...

vBulletin 3.x / 4.x AjaxReg SQL Injection

No description provided by source. !/usr/bin/php ? vBulletin 3.x/4.x AjaxReg remote Blind SQL Injection Exploit https://lh3.googleusercontent.com/-4HcW64E57CI/ULWN9mDnK8I/AAAAAAAAABo/cc0UA9eVak/s640/11-26-2012%25206-02-5s3%2520AM.png livedemo : http://www.youtube.com/watch?v=LlKaYyJxH7E check it ...

vBulletin Announcements Cookie Steal Vulnerability

If you get access to a forum with an acc that only has default acp, you can get all users information by creating a cookie stealer in announcements. vBulletin Announcements, by default has html enabled, so if you get access to a forum using other exploits and get a user with acp info, but it only...

vBulletin 3.x / 4.x AjaxReg SQL Injection

!/usr/bin/php userid key". "\n+ Ex. : php 0day.php localhost /vBulletin/ 1 abcdefghijklmnopqrstuvwxyz". "\n+ Note. : Its a 0day exploit\n\n"; exit ; function check $hostname, $path, $field, $pos, $usid, $char $char = ord $char; $inj = 'ajax.php?do=CheckUsername&param='; $inj.=...

vBulletin ajaxReg Module - SQL Injection

source: https://www.securityfocus.com/bid/56877/info The ajaxReg module for vBulletin is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. A successful exploit may allow an attacker to compromise the application,...

vBulletin ajaxReg Module - SQL Injection

vBulletin ajaxReg Module - SQL Injection source: https://www.securityfocus.com/bid/56877/info The ajaxReg module for vBulletin is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. A successful exploit may allow an...

vBulletin 4.x/5.x multiple Full Puth Disclosure Vulnerability

A large list of Full Path Disclosure for vBulletin /includes/api/commonwhitelist2.php /includes/api/commonwhitelist5.php /includes/api/commonwhitelist6.php /includes/api/1/albumalbum.php /includes/api/1/albumeditalbum.php /includes/api/1/albumlatest.php /includes/api/1/albumoverview.php...

vBulletin 4.2.0 Full Path Disclosure Vulnerability

Exploit for php platform in category web applications The Full Path Disclosure is vBulletin 4.2.0, in forumrunner. With Full Path Disclosure you can get the path to the forum you're in and also most of the times is the same cpanel's username. To see it go to:...

vBulletin 3.x <= 4.2.0 FAQ (Echo config) trick

By using this codes, you can echo config.php information, such as host, username and password. Go to acp, Faq Manager and then edit a FAQ, add the following code: $vbulletin-config'MasterServer''servername' $vbulletin-config'MasterServer''username' $vbulletin-config'MasterServer''password'...

vBulletin vBay 1.1.9 - Error-Based SQL Injection

!/usr/bin/env python -W ignore::DeprecationWarning """ VBay input variable "type" being assigned with the datatype NOHTML. Using this data type allows malicious attacks to still be executed. At line 448, it is used within the insert into statement, without any sanitization. POC - You will need to...

vBulletin vBay <=1.1.9 Error-Based SQL Injection

Exploit for php platform in category web applications !/usr/bin/env python -W ignore::DeprecationWarning """ VBay input variable "type" being assigned with the datatype NOHTML. Using this data type allows malicious attacks to still be executed. At line 448, it is used within the insert into...