PT-2005-3860 · Vbulletin Solutions · Vbulletin

Deluxe + 1 · Published 2005-09-21 · Updated 2016-10-18 · CVE-2005-3024

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions vBulletin versions 3.0.7 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via various parameters in different PHP files, including announcement in "announcement.php", thread[forumid] and criteria in "thread.php", userid in "user.php", and several others in "admincalendar.php", "cronlog.php", "email.php", "help.php", "usertitle.php", "language.php", "phrase.php", "template.php", and "usertools.php".

Recommendations For vBulletin versions 3.0.7 and earlier, consider disabling the SQL execution functionality until a patch is available. Restrict access to the vulnerable parameters, such as announcement, thread[forumid], criteria, userid, calendarcustomfieldid, calendarid, moderatorid, holidayid, calendarmoderatorid, calendar[0], cronid, user[usergroupid][0], help[0], limitnumber, limitstart, usertitleid, ids, rvt[0], keep[0], and dostyleid, to minimize the risk of exploitation. Avoid using these parameters in the affected API endpoints until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2005-3024

Affected Products

Vbulletin

References · 4

• 🔥 http://morph3us.org/advisories/20050917-vbulletin-3.0.7.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-3024 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3024 · Note
• http://marc.info/?l=bugtraq&m=112732980702939&w=2 · Note