An Analysis of the vBulletin 5.x Remote Code Execution Exploit

vBulletin is a commercial Internet forum software package, boasting tens of thousands of users which are growing rapidly worldwide. It is written in the PHP web language and uses the MySQL database. Owing to its large user base, vBulletin is frequently reported to have vulnerabilities. In NSFOCUS Vulnerability Database (NSVD), there are 49 entries related to vBulletin, most of which are SQL injection vulnerabilities. The vulnerability disclosed this time is of a relatively high risk level, known as remote code execution (RCE). Theoretically, an attacker can exploit this vulnerability to execute arbitrary code or even take complete control of a forum that uses this program.


vBulletin 是一个商用的论坛程序套件,在全球拥有数万用户且增长速度很快。该论坛采用PHP Web语言及MySQL数据库。正是由于其用户较多,其漏洞出现频率较高,在绿盟科技漏洞库(NSVD)中共有[49条记录][1],大部分是SQL注入漏洞。此次漏洞等级较高,为远程代码执行漏洞(RCE),理论上说攻击者可执行任意代码,甚至完全控制论坛 。