PT-2005-1491 · Vbulletin Solutions · Vbulletin

Al3Ndaleeb · Publicado 2005-02-15 · Atualizado 2016-10-18 · CVE-2005-0429

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions vBulletin versions 3.0 through 3.0.4

Description A direct code injection issue exists when the showforumusers option is enabled, allowing remote attackers to execute arbitrary PHP commands. This is achieved by injecting code via the comma parameter in the forumdisplay.php file.

Recommendations For vBulletin versions 3.0 through 3.0.4, consider disabling the showforumusers option as a temporary workaround until a patch is available. Restrict access to the forumdisplay.php file to minimize the risk of exploitation. Avoid using the comma parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2005-0429

Produtos afetados

Vbulletin

Referências · 6

• 🔥 https://exploit-db.com/exploits/820 · Exploit
• 🔥 https://exploit-db.com/exploits/818 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0429 · Nota
• http://marc.info/?l=bugtraq&m=110840807415315&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-0429 · Nota de Segurança
• http://securityfocus.com/bid/12542 · Nota