Goal Reached Thanks to every supporter โ€” we hit 100%!

Goal: 1000 CNY ยท Raised: 1336 CNY

100%

CVE-2016-6195 โ€” AI Deep Analysis Summary

Q1What is this vulnerability? (Essence + Consequences)

๐Ÿšจ **Essence**: SQL Injection in vBulletin's `forumrunner` module. ๐Ÿ“‰ **Consequences**: Attackers can execute arbitrary SQL commands, leading to potential data theft or system compromise.

Q2Root Cause? (CWE/Flaw)

๐Ÿ›ก๏ธ **Root Cause**: Improper input validation in `forumrunner/includes/moderation.php`. ๐Ÿ’ฅ **Flaw**: The `postids` parameter in `forumrunner/request.php` is not sanitized, allowing SQL injection.

Q3Who is affected? (Versions/Components)

๐Ÿ‘ฅ **Affected**: vBulletin versions **< 4.2.2 Patch Level 5** AND **< 4.2.3 Patch Level 1**. ๐Ÿ“ฆ **Component**: Specifically the `forumrunner` addon/core.

Q4What can hackers do? (Privileges/Data)

๐Ÿ’€ **Capabilities**: Execute arbitrary SQL queries. ๐Ÿ”“ **Impact**: Access sensitive database information, potentially compromising user data or site integrity.

Q5Is exploitation threshold high? (Auth/Config)

๐Ÿ”“ **Threshold**: **LOW**. ๐ŸŒ **Auth**: Remote exploitation possible. โš™๏ธ **Config**: No authentication required to send the malicious `postids` parameter.

Q6Is there a public Exp? (PoC/Wild Exploitation)

๐Ÿ”ฅ **Exploit**: **YES**. ๐Ÿ“‚ **PoC**: Available via Nuclei templates (ProjectDiscovery) and tools like `vbully`. ๐ŸŒ **Wild Exploitation**: Publicly documented.

Q7How to self-check? (Features/Scanning)

๐Ÿ” **Check**: Scan for vBulletin versions < 4.2.3 PL1. ๐Ÿ“ก **Feature**: Look for the `forumrunner/request.php` endpoint accepting `postids`. ๐Ÿ› ๏ธ **Tool**: Use Nuclei templates for automated detection.

Q8Is it fixed officially? (Patch/Mitigation)

โœ… **Fixed**: **YES**. ๐Ÿฉน **Patch**: Update to vBulletin **4.2.2 PL5** or **4.2.3 PL1** or later. ๐Ÿ“… **Date**: Patched around Aug 2016.

Q9What if no patch? (Workaround)

๐Ÿšง **Workaround**: If patching is impossible, **disable the `forumrunner` addon** immediately. ๐Ÿšซ **Block**: Restrict access to `forumrunner/request.php` via WAF rules if possible.

Q10Is it urgent? (Priority Suggestion)

โš ๏ธ **Priority**: **HIGH**. ๐Ÿšจ **Urgency**: Critical SQLi with remote exploit code available. ๐Ÿƒ **Action**: Patch immediately or disable the vulnerable module to prevent data breaches.