CVE-2019-17132

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

• vBulletin 5.0 < 5.5.4 - 'updateAvatar' Authenticated Remote Code Execution2019-10-07 · webapps · php

Impact

vBulletin through 5.5.4 mishandles custom avatars.

Affected products

Weakness classification

References

• NVD record
• CVE.org record
• http://packetstormsecurity.com/files/154759/vBulletin-5.5.4-Remote-Code-Execution.html
• http://seclists.org/fulldisclosure/2019/Oct/9
• https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4423646-vbulletin-5-5-x-5-5-2-5-5-3-and-5-5-4-security-patch-level-2
• http://packetstormsecurity.com/files/154759/vBulletin-5.5.4-Remote-Code-Execution.html
• http://seclists.org/fulldisclosure/2019/Oct/9
• https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4423646-vbulletin-5-5-x-5-5-2-5-5-3-and-5-5-4-security-patch-level-2