CVE-2013-6129

EXPLOITED IN THE WILD

Vbulletin - Access Control

Title source: rule

Description

The install/upgrade.php scripts in vBulletin 4.1 and 5 allow remote attackers to create administrative accounts via the customerid, htmldata[password], htmldata[confirmpassword], and htmldata[email] parameters, as exploited in the wild in October 2013.

Exploits (2)

metasploit WORKING POC
by Unknown, juan vazquez · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/vbulletin_upgrade_admin.rb
exploitdb WORKING POC VERIFIED
by Joshua Rogers · perlwebappsphp
https://www.exploit-db.com/exploits/38785

References (2)

Scores

EPSS 0.7442
EPSS Percentile 98.8%

Exploitation Intel

VulnCheck KEV 2013-10-19
InTheWild.io 2013-11-21

Classification

CWE
CWE-264
Status draft

Affected Products (2)

vbulletin/vbulletin
vbulletin/vbulletin

Timeline

Published Oct 19, 2013
Tracked Since Feb 18, 2026