CVE-2016-6195
critical · 9.8A public exploit / detection template exists
Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →
SQL injection vulnerability in forumrunner/includes/moderation.php in vBulletin before 4.2.2 Patch Level 5 and 4.2.3 before Patch Level 1 allows remote attackers to execute arbitrary SQL commands via the postids parameter to forumrunner/request.php, as exploited in the wild in July 2016.
9.8
CVSS
68.5%
EPSS (exploit prob.)
99th
EPSS percentile
2016-08-30
Published
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| vbulletin | vbulletin | <= 4.2.2 |
| vbulletin | vbulletin | 4.2.3 |
Check a specific version with /api/v1/cve/match.
References
- http://www.securityfocus.com/bid/92687
- http://www.vbulletin.org/forum/showthread.php?t=322848
- https://enumerated.wordpress.com/2016/07/11/1/
- https://github.com/drewlong/vbully
- http://www.securityfocus.com/bid/92687
- http://www.vbulletin.org/forum/showthread.php?t=322848
- https://enumerated.wordpress.com/2016/07/11/1/
- https://github.com/drewlong/vbully
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2016-6195