CVE-2016-6195 SQL injection vulnerability in forumrunner/includes/moderation.php in vBulletin before 4.2.2 Patch Level 5 and 4.2.3 before Patch Level 1 allows remote attackers to execute arbitrary SQL commands via....
CriticalCVSS 9.8
EPSS 70.9%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
SQL injection vulnerability in forumrunner/includes/moderation.php in vBulletin before 4.2.2 Patch Level 5 and 4.2.3 before Patch Level 1 allows remote attackers to execute arbitrary SQL commands via the postids parameter to forumrunner/request.php, as exploited in the wild in July 2016.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vbulletin | <= 4.2.2 | No fix listed |
| vbulletin | = 4.2.3 | No fix listed |
References
- 92687 vdb-entry
- www.vbulletin.org vendor-advisory
- enumerated.wordpress.com technical-description third-party-advisory
- github.com