PT-2007-2707 · Vbulletin Solutions · Vbulletin

Rgod · Published 2007-03-07 · Updated 2017-10-11 · CVE-2007-1292

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions vBulletin versions prior to 3.5.8 vBulletin versions 3.6.x prior to 3.6.5

Description A SQL injection issue might allow remote authenticated users to execute arbitrary SQL commands via the postids parameter in the inlinemod.php file. The vendor notes that the attack is feasible only in very specific, difficult-to-achieve circumstances.

Recommendations For versions prior to 3.5.8, update to version 3.5.8 or later. For versions 3.6.x prior to 3.6.5, update to version 3.6.5 or later. As a temporary workaround, consider restricting access to the inlinemod.php file until a patch is available. Avoid using the postids parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2007-1292

Affected Products

Vbulletin

References · 8

• 🔥 https://exploit-db.com/exploits/3387 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-1292 · Security Note
• http://vbulletin.com/forum/showthread.php?postid=1314422 · Vendor Advisory
• http://secunia.com/advisories/24341 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1292 · Note
• http://osvdb.org/33835 · Note
• http://securityfocus.com/bid/22780 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32746 · Note