[Unpatched] Critical 0-Day RCE Exploit for vBulletin Forum Disclosed Publicly

An nameless hack now doors disclosed particulars and proof-of-concept achievement code for an unpatched, vital zero-day removed code execution exposure inwards vBulletin—leak of issues wide worn net agora package, Issues Cyberpunk Intelligence has self.



Leak of issues cons wherefore issues exposure ought to live considered arsenic a extreme number is non simply from it's remotely exploitable, only too does not require certification.



Hand inwards PHP, vBulletin is a wide worn proprietorship Cyberspace agora package bundle that powers more than than 100,000 web sites along issues Cyberspace, together with Fortune 500 and Alexa Prime one million corporations web sites and boards.



In accordance with particulars published along issues Total Revelation posting listing, issues hack claims to hold discovered a removed code execution exposure that seems to covet vBulletin variations 5.0.Zero trough issues last 5.5.4.

Issues Cyberpunk Intelligence has severally true that issues fault plant, arsenic described, and impacts issues last model of vBulletin package, which finally leaves hundreds of agora web sites astatine threat of hacking.



Issues exposure resides inwards issues manner an inner widget lodge of issues agora package bundle accepts configurations through issues URL parameters and so parse them along issues waiter from right security checks, permitting attackers to interpose instructions and remotely make code along issues scheme.

Equally a proof-of-concept, issues hack has too discharged a python-based achievement that would do it simpler for anybody to achievement issues zero-day inwards issues wild.



Sol interahamwe, issues Usual Vulnerabilities and Exposures (CVE) quantity has non been assigned to issues exposure.

Issues Cyberpunk Intelligence has too knowledgeable vBulletin projection maintainers around issues exposure revelation and wait them to patch issues safety number ahead hackers upon exploiting it to focus on vBulletin installations.



A separate cybersecurity investigator analyzed issues core reason of this vulnerability and posted particulars shortly after Issues Cyberpunk Intelligence issue issues story.



Meantime, a GitHub exploiter too discharged a simple script that would allow anybody rake issues Cyberspace to regain vBulletin web sites utilizing Shodan search locomotive and mechanically bank check for tender websites.



We testament replace issues story and inform issues readers through sociable media arsenic shortly arsenic we understand dorsum from issues vBulletin maintainers.

Replace — Hackers Rebus Exploiting vBulletin Null-Daytime; Patches At present Useable

In accordance with a number of infosec profession sources inwards contact with Issues Cyberpunk Intelligence, versatile hacking teams and private põrnikas hunters hold already began scanning issues Cyberspace to focus on tender vBulletin web sites.



After Issues Cyberpunk Intelligence skint issues tidings and knowledgeable issues vBulletin squad around issues zero-day people revelation, at present tracked arsenic CVE-2019-16759, issues projection maintainers now discharged security patches for vBulletin variations 5.5.2, 5.5.3, and 5.5.4.

Hold one thing to say around this story? Remark under oregon percentage it with usa along Facebook, Twitter oregon our LinkedIn Group.