vBulletin through 5.5.4 mishandles custom avatars.

According to the self-reported version in its response header, the version of vBulletin hosted on the remote web server is 5.5.x < 5.5.2 Patch Level 2, 5.5.3 < 5.5.3 Patch Level 2 or 5.5.4 < 5.5.4 Patch Level 2. It is, therefore, affected by multiples vulnerabilities :

- A SQL injection vulnerability via the ajax/api/hook/getHookList or ajax/api/widget/getWidgetList where parameter

- A remote code execution vulnerability via data[extension] and data[filedata] parameters within ajax/api/user/updateAvatar endpoint

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
98776	vBulletin 5.5.x < 5.5.2 Patch Level 2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
98775	vBulletin 5.5.3 < 5.5.3 Patch Level 2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
98774	vBulletin 5.5.4 < 5.5.4 Patch Level 2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical

Detections

Analytics

CVE-2019-17132

critical

Tenable Plugins

critical

critical

critical