CVE-2013-6129

The install/upgrade.php scripts in vBulletin 4.1 and 5 allow remote attackers to create administrative accounts via the customerid, htmldata[password], htmldata[confirmpassword], and htmldata[email] parameters, as exploited in the wild in October 2013.

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

51.89% chance of exploitation in the next 30 days, 99th percentile

Published

2013-10-19

Updated

2024-09-16

Proof-of-concept exploits (1)

• http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/3…

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/vbulletin_upgrade_ad…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/38785

References

• CVE Record
• NVD entry

Related

• CVE-2013-6128
• CVE-2013-6162
• CVE-2013-6127
• CVE-2013-6164
• CVE-2013-6117
• CVE-2013-6166