PT-2007-2707 · Vbulletin Solutions · Vbulletin

Rgod · Publicado 2007-03-07 · Atualizado 2017-10-11 · CVE-2007-1292

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions vBulletin versions prior to 3.5.8 vBulletin versions 3.6.x prior to 3.6.5

Description A SQL injection issue might allow remote authenticated users to execute arbitrary SQL commands via the postids parameter in the inlinemod.php file. The vendor notes that the attack is feasible only in very specific, difficult-to-achieve circumstances.

Recommendations For versions prior to 3.5.8, update to version 3.5.8 or later. For versions 3.6.x prior to 3.6.5, update to version 3.6.5 or later. As a temporary workaround, consider restricting access to the inlinemod.php file until a patch is available. Avoid using the postids parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2007-1292

Produtos afetados

Vbulletin

Referências · 8

• 🔥 https://exploit-db.com/exploits/3387 · Exploit
• http://secunia.com/advisories/24341 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1292 · Nota
• http://osvdb.org/33835 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-1292 · Nota de Segurança
• http://securityfocus.com/bid/22780 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32746 · Nota
• http://vbulletin.com/forum/showthread.php?postid=1314422 · Aviso do Fabricante