CVE-2017-17671 vBulletin through 5.3.x on Windows allows remote PHP code execution because a require_once call is reachable with an unauthenticated request that can include directory traversal sequences to specify a...
CriticalCVSS 9.8
EPSS 3.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
vBulletin through 5.3.x on Windows allows remote PHP code execution because a require_once call is reachable with an unauthenticated request that can include directory traversal sequences to specify an arbitrary pathname, and because ../ traversal is blocked but ..\ traversal is not blocked. For example, an attacker can make an invalid HTTP request containing PHP code, and then make an index.php?routestring= request with enough instances of ".." to reach an Apache HTTP Server log file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vbulletin | >= 5.0.1, <= 5.3.3 | No fix listed |
| vbulletin | = 5.0.0-beta_11 | No fix listed |
| vbulletin | = 5.0.0-beta_28 | No fix listed |
References
- blogs.securiteam.com exploit third-party-advisory