Vulnerability Details : CVE-2013-6129

Public exploit exists!
The install/upgrade.php scripts in vBulletin 4.1 and 5 allow remote attackers to create administrative accounts via the customerid, htmldata[password], htmldata[confirmpassword], and htmldata[email] parameters, as exploited in the wild in October 2013.
Published 2013-10-19 10:36:10
Updated 2013-11-21 19:20:40
Source MITRE
View at NVD,   CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2013-6129

Probability of exploitation activity in the next 30 days: 75.99%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 98 % EPSS Score History EPSS FAQ

Metasploit modules for CVE-2013-6129

  • vBulletin Administrator Account Creation
    Disclosure Date: 2013-10-09
    First seen: 2020-04-26
    auxiliary/admin/http/vbulletin_upgrade_admin
    This module abuses the "install/upgrade.php" component on vBulletin 4.1+ and 4.5+ to create a new administrator account, as exploited in the wild on October 2013. This module has been tested successfully on vBulletin 4.1.5 and 4.1.0. Authors: - Unknown - j

CVSS scores for CVE-2013-6129

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source
7.5
 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P
10.0
6.4
 NIST

CWE ids for CVE-2013-6129

  • Assigned by: nvd@nist.gov (Primary)

References for CVE-2013-6129

Products affected by CVE-2013-6129

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close