Exploits in the Wild for vBulletin Pre-Auth RCE Vulnerability CVE-2019-16759
Summary: Unit 42 researchers identified active in-the-wild exploitation of CVE-2019-16759, a pre-auth remote code execution vulnerability in vBulletin versions 5.0.0 through 5.5.4 with a 9.8 CVSS v3.1 base score, caused by PHP server-side template injection in the Ajax render function. Observed attacks included a failed die(@md5(HellovBulletin)) probe, creation of a one-line PHP webshell named webconfig.txt.php in the web root, and an attempt to overwrite bbcode.php so evalCode() would only run when a request carried the value 2dmfrb28nu3c6s9j.
What you should know: More than 100,000 sites run vBulletin, including forums of major enterprises, and an unauthenticated attacker who succeeds can gain privileged control and lock an organization out of its own site - while the bbcode.php overwrite shows one attacker trying to reserve a compromised server for its own botnet C2 and shut other attackers out.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2019-16759
- Related
- CVE-2019-16759: vBulletin PHP Module Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021