CVE-2019-16759 PoC — vBulletin 输入验证错误漏洞

Source

https://github.com/ludy-dev/vBulletin_Routestring-RCE

Associated Vulnerability

Title:vBulletin 输入验证错误漏洞 (CVE-2019-16759)
Description:vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.

Description

(CVE-2019-16759) vBulletin_Routestring-RCE

Readme

# [CVE-2019-16759]vBulletin_Routestring-RCE-PoC
A vulnerability has been discovered in vBulletin which could allow for remote code execution when a malicious POST request is sent to the vulnerable application. 
The vulnerability is due to an input validation error while parsing a HTTP request in the vulnerable module. 

System Affected : 

vBulletin Version 5.0.0 ~ 5.5.4 
(Updated System affected) vBulletin Version 5.0.0 ~ 5.6.2

Usage>

    python vBulletin_Routestring-RCE.py <dst_ip> <dst_port> (User defined port) 

    python vBulletin_Routestring-RCE.py <dst_ip> (default Port:80)   

Script was editted for Python3 


Not For attack. just using Vuln Test for your System

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!