Main
Vulnerability Database
Exploits
ID:3816 - Exploit for Input validation error in vBulletin - CVE-2015-7808
ID:3816 - Exploit for Input validation error in vBulletin - CVE-2015-7808
Published: August 9, 2020
Vulnerability identifier: #VU40590
Vulnerability risk: Medium
CVE-ID: CVE-2015-7808
CWE-ID: CWE-20
Exploitation vector: Remote access
Vulnerable software:
vBulletin
vBulletin
Link to public exploit:
Vulnerability description
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The vB_Api_Hook::decodeArguments method in vBulletin 5 Connect 5.1.2 through 5.1.9 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object in the arguments parameter to ajax/api/hook/decodeArguments.
Remediation
Install update from vendor's website.