PT-2014-6279 · Vbulletin Solutions · Vbulletin

Publicado 2014-07-25 · Atualizado 2015-10-06 · CVE-2014-5102

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions vBulletin versions 5.0.4 through 5.1.3 Alpha 5

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the criteria[startswith] parameter to the "ajax/render/memberlist items" endpoint.

Recommendations For versions 5.0.4 through 5.1.3 Alpha 5, avoid using the criteria[startswith] parameter in the "ajax/render/memberlist items" endpoint until the issue is resolved.

Exploit

Correção

RCE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2014-5102

Produtos afetados

Vbulletin

Referências · 6

• 🔥 http://packetstormsecurity.com/files/127537/vBulletin-5.1.2-SQL-Injection.html · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5102 · Nota
• http://securityfocus.com/bid/68709 · Nota
• http://pcworld.com/article/2455500/emergency-vbulletin-patch-fixes-dangerous-sql-injection-vulnerability.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-5102 · Nota de Segurança
• http://vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/4097503-security-patch-release-for-vbulletin-5-0-4-5-0-5-5-1-0-5-1-1-and-5-1-2 · Aviso do Fabricante