As soon as releasing a patch for zero-day remote code execution vulnerability late last month, vBulletin has recently published a new patch update for three vulnerabilities
As soon as releasing a patch for zero-day remote code execution vulnerability late last month, vBulletin has recently published a new patch update for three vulnerabilities.
vBulletin published a new security patch update that addresses 3 more high-severity flaws in vBulletin 5.5.4 and prior versions.
vBulletin
vBulletin is a proprietary Internet software package. It is written in PHP and uses a MySQL database server. vBulletin powers over 100,000 websites on the internet.
The three vulnerabilities
Remote code execution flaw CVE-2019-17132 is the first vulnerability discovered by security researcher Egidio Romano.
The RCE flaw resides in the way vBulletin forum handles user requests to update avatars for their profiles, an icon or graphics representation of the user, allowing a remote attacker to inject and execute arbitrary PHP code on the target server through unsanitized parameters.
The vulnerability cannot be triggered in the default installation of the vBulletin forum, but exploitation is possible when “Save Avatars as Files” option is enabled by the website administrator.
The remaining critical vulnerabilities tracked as CVE-2019-17271 are read in-band and time-based SQL injection issues that are present in the two endpoints and cloud allow administrators with restricted privileges to read sensitive data from the database, which cannot be accessed otherwise.
vBulletin forum administrators need not panic as these two SQL injection flaws cannot be exploited by any registered user and require special permissions.
Romano reported all the flaws to the vBulletin maintainers on September 30 that released the following security patch updates.
If left unpatched, the vulnerabilities could be exploited by remote attackers to take complete control over targeted web servers and steal sensitive user information.
Apply security patches
The administrators are highly recommended to apply the security patch before the hackers start exploiting the vulnerabilities to target their forum users.
For the latest cyber threats and the latest hacking news please follow us on Facebook, Linkedin, and Twitter.
You may be interested in reading: EX – YAHOO EMPLOYEE SNEAKS INTO 6000 ACCOUNTS FOR SEXUAL CONTENT