PT-2020-6319 · Vbulletin · Vbulletin

Zenofex · Published 2020-08-12 · Updated 2025-11-07 · CVE-2020-17496

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions vBulletin versions 5.5.4 through 5.6.2

Description The issue allows remote command execution via crafted subWidgets data in an "ajax/render/widget tabbedcontainer tab panel" request. This is due to an incomplete fix for a previous issue. The vulnerability can be exploited by a remote attacker to execute arbitrary commands. It has been reported that this issue is being actively exploited in the wild.

Recommendations For versions 5.5.4 through 5.6.2, consider disabling the ajax/render/widget tabbedcontainer tab panel request until a patch is available. Restrict access to the subWidgets data to minimize the risk of exploitation.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

BDU:2021-04176

CVE-2020-17496

Affected Products

Vbulletin

References · 14

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/vbulletin_widget_template_rce.rb · Exploit
• 🔥 https://github.com/ludy-dev/vBulletin_5.x-tab_panel-RCE · Exploit
• 🔥 https://blog.exploitee.rs/2020/exploiting-vbulletin-a-tale-of-patch-fail · Exploit
• 🔥 https://seclists.org/fulldisclosure/2020/Aug/5 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-17496 · Security Note
• https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4445227-vbulletin-5-6-0-5-6-1-5-6-2-security-patch · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04176 · Security Note
• https://osv.dev/vulnerability/CVE-2020-17496 · Vendor Advisory
• https://cwe.mitre.org/data/definitions/78.html · Note
• https://t.me/cveNotify/142160 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-17496 · Note
• https://twitter.com/anand_himanshu/status/1831635609049251890 · Twitter Post
• https://t.me/true_secator/2035 · Telegram Post
• https://t.me/cibsecurity/15753 · Telegram Post