Published: 10/05/2013 Updated: 04/06/2020

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 755

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Multiple SQL injection vulnerabilities in Vanilla Forums prior to 2.0.18.8 allow remote malicious users to execute arbitrary SQL commands via the parameter name in the Form/Email array to (1) entry/signin or (2) entry/passwordrequest.

Vulnerable Product	Search on Vulmon	Subscribe to Product
vanillaforums vanilla 2.0.18.3
vanillaforums vanilla 2.0.18.1
vanillaforums vanilla 2.0.18
vanillaforums vanilla 2.0.17.4
vanillaforums vanilla 2.0.17.8
vanillaforums vanilla 2.0.17.9
vanillaforums vanilla 2.0.12
vanillaforums vanilla 2.0.11
vanillaforums vanilla 2.0.4
vanillaforums vanilla 2.0.3
vanillaforums vanilla
vanillaforums vanilla 2.0.18.6
vanillaforums vanilla 2.0.18.5
vanillaforums vanilla 2.0.18.4
vanillaforums vanilla 2.0.17
vanillaforums vanilla 2.0.17.10
vanillaforums vanilla 2.0.15
vanillaforums vanilla 2.0.14
vanillaforums vanilla 2.0.13
vanillaforums vanilla 2.0.6
vanillaforums vanilla 2.0.5
vanillaforums vanilla 2.0.17.3
vanillaforums vanilla 2.0.17.1
vanillaforums vanilla 2.0.16
vanillaforums vanilla 2.0.16.1
vanillaforums vanilla 2.0.8
vanillaforums vanilla 2.0.7
vanillaforums vanilla 2.0.17.5
vanillaforums vanilla 2.0.17.2
vanillaforums vanilla 2.0.17.6
vanillaforums vanilla 2.0.17.7
vanillaforums vanilla 2.0.10
vanillaforums vanilla 2.0.9
vanillaforums vanilla 2.0.2
vanillaforums vanilla 2.0.1

# Exploit Title: Vanilla Forums - SQL-Injection - Insert arbitrary user & dump usertable # Date: 04/05/2013 # Exploit Author: bl4ckw0rm # Vendor Homepage: vanillaforumsorg/ # Version: 2-0-18-4 # Tested on: Windows Product Name: Vanilla Forums Vulnerable Version: Up to vanilla-core-2-0-18-4 Tested on: Windows Server 2003 Apache 24 ...

CWE-89 http://seclists.org/fulldisclosure/2013/Apr/57 https://github.com/vanillaforums/Garden/commit/83078591bc4d263e77d2a2ca283100997755290d http://secunia.com/advisories/52825 http://packetstormsecurity.com/files/121151/Vanilla-Forums-2.0.18.4-SQL-Injection.html http://osvdb.org/92109 http://osvdb.org/92110 http://archives.neohapsis.com/archives/bugtraq/2013-04/0068.html http://www.exploit-db.com/exploits/24927 http://www.securityfocus.com/bid/58922 http://mfs-enterprise.com/wordpress/2013/04/05/vanilla-forums-2-0-18-sql-injection-insert-arbitrary-user-dump-usertable/http://vanillaforums.org/discussion/23339/security-update-vanilla-2-0-18-7 https://exchange.xforce.ibmcloud.com/vulnerabilities/83289 https://nvd.nist.gov https://www.exploit-db.com/exploits/24927/

CVE-2013-3527

Vulnerability Summary

Vulnerability Trend

Exploits

References

Vulmon Search

About

Products

Connect