7.5high
CVE-2005-0511in critical feed3 exploits
misc.php for vBulletin 3.0.6 and earlier, when "Add Template Name in HTML Comments" is enabled, allows remote attackers to execute arbitrar…
Published 21 y ago · modified 4 mo ago · JSON
CVSS
7.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
35.8%
percentile 98%
Public exploits
3
Metasploit · Exploit-DB
Summary
misc.php for vBulletin 3.0.6 and earlier, when "Add Template Name in HTML Comments" is enabled, allows remote attackers to execute arbitrary PHP code via nested variables in the template parameter.
Exploit prediction (EPSS)
35.82% probability of exploitation in the next 30 days, higher than 98% of all scored CVEs.
Exploits and detections
- Metasploit exploit/unix/webapp/php_vbulletin_template vBulletin misc.php Template Name Arbitrary Code Execution · metasploit exploit, excellent rank · 2005-02-25
- EDB-832 vBulletin 3.0.6 - PHP Code Injection · webapps · 2005-02-22
- EDB-16896 vBulletin - 'misc.php' Template Name Arbitrary Code Execution (Metasploit) · webapps · 2010-07-25
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
References
- secunia.com /advisories/14326 · third-party-advisory, x_refsource_SECUNIA, x_transferred
- vbulletin.com /forum/showthread.php?postid=819562 · x_refsource_CONFIRM, x_transferred
- marc.info /?l=bugtraq&m=110910899415763&w=2 · mailing-list, x_refsource_BUGTRAQ, x_transferred
- securityfocus.com /bid/12622 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2005-0511
- NVD: CVE-2005-0511
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.