CVE-2013-6129 | BDVDB-2026-58112 Detail

Description#

The install/upgrade.php scripts in vBulletin 4.1 and 5 allow remote attackers to create administrative accounts via the customerid, htmldata[password], htmldata[confirmpassword], and htmldata[email] parameters, as exploited in the wild in October 2013.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/3991423-potential-vbulletin-exploit-vbulletin-4-1-vbulletin-5
http://www.net-security.org/secworld.php?id=15743

Exploit#

No public exploit known

History#

Version 12013-10-19Record published in the CVE List.
Version 22024-09-16Most recent update recorded in the CVE List.