medium4.9
CVE-2019-17271
vBulletin 5.5.4 allows SQL Injection via the ajax/api/hook/getHookList or ajax/api/widget/getWidgetList where parameter.
Impact
vBulletin 5.5.4 allows SQL Injection via the ajax/api/hook/getHookList or ajax/api/widget/getWidgetList where parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vbulletin | Vbulletin | through 5.5.4 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/154758/vBulletin-5.5.4-SQL-Injection.html
- https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa
- http://packetstormsecurity.com/files/154758/vBulletin-5.5.4-SQL-Injection.html
- https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa