critical9.8Public exploit code
CVE-2014-2023
Multiple SQL injection vulnerabilities in the Tapatalk plugin 4.9.0 and earlier and 5.x through 5.2.1 for vBulletin allow remote attackers to execute arbitrary…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Tapatalk for vBulletin 4.x - Blind SQL Injection2014-10-28 · webapps · php
Impact
Multiple SQL injection vulnerabilities in the Tapatalk plugin 4.9.0 and earlier and 5.x through 5.2.1 for vBulletin allow remote attackers to execute arbitrary SQL commands via a crafted xmlrpc API request to (1) unsubscribe_forum.php or (2) unsubscribe_topic.php in mobiquo/functions/.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Tapatalk | Tapatalk | Versions 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, 1.1.2 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/128854/vBulletin-4.x-Tapatalk-Blind-SQL-Injection.html
- http://seclists.org/fulldisclosure/2014/Oct/57
- http://www.exploit-db.com/exploits/35102
- http://www.securityfocus.com/bid/70418
- https://github.com/tintinweb/pub/tree/master/pocs/cve-2014-2023
- http://packetstormsecurity.com/files/128854/vBulletin-4.x-Tapatalk-Blind-SQL-Injection.html
- http://seclists.org/fulldisclosure/2014/Oct/57
- http://www.exploit-db.com/exploits/35102
- http://www.securityfocus.com/bid/70418
- https://github.com/tintinweb/pub/tree/master/pocs/cve-2014-2023