CVE-2017-17671

CRITICAL

vBulletin <= 5.3.x - Unauthenticated Remote Code Execution via Path Traversal

Title source: llm
STIX 2.1

Description

vBulletin through 5.3.x on Windows allows remote PHP code execution because a require_once call is reachable with an unauthenticated request that can include directory traversal sequences to specify an arbitrary pathname, and because ../ traversal is blocked but ..\ traversal is not blocked. For example, an attacker can make an invalid HTTP request containing PHP code, and then make an index.php?routestring= request with enough instances of ".." to reach an Apache HTTP Server log file.

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://blogs.securiteam.com/index.php/archives/3569

Scores

CVSS v3 9.8
EPSS 0.0305
EPSS Percentile 85.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-22
Status published
Products (2)
vbulletin/vbulletin 5.0.0 beta_11 (2 CPE variants)
vbulletin/vbulletin 5.0.1 - 5.3.3
Published Dec 14, 2017
Tracked Since Feb 18, 2026