CVE-2014-2022 SQL injection vulnerability in includes/api/4/breadcrumbs_create.php in vBulletin 4.2.2, 4.2.1, 4.2.0 PL2, and earlier allows remote authenticated users to execute arbitrary SQL commands via the conce...
HighCVSS 7.1
EPSS 2.7%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
SQL injection vulnerability in includes/api/4/breadcrumbs_create.php in vBulletin 4.2.2, 4.2.1, 4.2.0 PL2, and earlier allows remote authenticated users to execute arbitrary SQL commands via the conceptid argument in an xmlrpc API request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vbulletin | <= 4.2.2 | No fix listed |
| vbulletin | = 4.2.0-pl2 | No fix listed |
| vbulletin | = 4.2.1 | No fix listed |
References
- packetstormsecurity.com exploit
- 20141013 CVE-2014-2022 - vbulletin 4.x - SQLi in breadcrumbs via xmlrpc API (post-auth) exploit mailing-list
- 70417 vdb-entry
- 1031001 vdb-entry
- github.com exploit