CVEvulnerability
CVE-2014-2022
7.1 HIGH
Official page ↗
- Status
- Modified
- Published
- 2014-10-15
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.1 HIGH — AV:N/AC:H/Au:S/C:C/I:C/A:C
- Weaknesses
- CWE-89
Description
SQL injection vulnerability in includes/api/4/breadcrumbs_create.php in vBulletin 4.2.2, 4.2.1, 4.2.0 PL2, and earlier allows remote authenticated users to execute arbitrary SQL commands via the conceptid argument in an xmlrpc API request.
Affected configurations
• vbulletin vbulletin (<= 4.2.2)
• vbulletin vbulletin 4.2.0
• vbulletin vbulletin 4.2.1
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- http://packetstormsecurity.com/files/128696/vBulletin-4.x-SQL-Injection.html Exploit
- http://seclists.org/fulldisclosure/2014/Oct/56 Exploit
- http://www.securityfocus.com/bid/70417 www.securityfocus.com
- http://www.securitytracker.com/id/1031001 www.securitytracker.com
- https://github.com/tintinweb/pub/tree/master/pocs/cve-2014-2022 Exploit
- http://packetstormsecurity.com/files/128696/vBulletin-4.x-SQL-Injection.html Exploit
- http://seclists.org/fulldisclosure/2014/Oct/56 Exploit
- http://www.securityfocus.com/bid/70417 www.securityfocus.com
- http://www.securitytracker.com/id/1031001 www.securitytracker.com
- https://github.com/tintinweb/pub/tree/master/pocs/cve-2014-2022 Exploit