CVE-2020-17496 PoC — vBulletin 注入漏洞

Source

https://github.com/ludy-dev/vBulletin_5.x-tab_panel-RCE

Associated Vulnerability

Title: vBulletin 注入漏洞 (CVE-2020-17496)
Description:vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759.

Description

(CVE-2020-17496) vBulletin 5.x Widget_tabbedcontainer_tab_panel RCE Vuln Test script

Readme

# vBulletin_5.x-tab_panel-RCE
[CVE-2020-17496] is a vulnerability in vBulletin’s ajax/render/widget_php route by injecting malicious code via the widgetConfig parameter.

Affected System
vBulletin 5.5.4 ~ 5.6.2

vBulletin 5.x Widget_tabbedcontainer_tab_panel RCE Vuln Test script

Usage>

    python vBulletin_5.x-tab_panel-RCE.py <dst_ip> <dst_port> (user defined port)
    
    python vBulletin_5.x-tab_panel-RCE.py <dst_ip> (default : 80/tcp)
    
Script is working on Python3 (2020.11.07 updated)

Just using Vuln Test for your System

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →