vbulletin5 rce vulnerability detection tool

0x00 Overview

In September 2019, vbulletin5 (5.0.0-5.5.4) disclosed an RCE vulnerability (CVE-2019-16759). Using the file ajax/render/widget_php and the POST parameter widgetConfig[code], remote code execution can be directly achieved.

On August 11, 2020, a bypass for the CVE-2019-16759 patch was disclosed online. By exploiting ajax/render/widget_tabbedcontainer_tab_panel and crafting the POST parameter subWidgets[0][config][code], remote code execution can be directly achieved.

This tool supports single URL detection, command shell, web shell injection (writing a one-liner webshell), batch detection, and batch webshell injection.

0x01 Requirements

python2.7

pip install requests

0x02 Quick Start

Usage help: python vbulletin5-rce.py -h

Single URL vulnerability detection: python vbulletin5-rce.py -u "http://www.xxx.com/"

Command shell: python vbulletin5-rce.py -u "http://www.xxx.com/" --cmdshell

Single URL webshell injection: python vbulletin5-rce.py -u "http://www.xxx.com/" --getshell

Batch detection: python vbulletin5-rce.py -f urls.txt

Batch webshell injection: python vbulletin5-rce.py -f urls.txt --getshell

0x03 Feedback

Issues

Gmail: [email protected]

QQ: [email protected]