CVE-2005-0511: High severity Jelsoft vBulletin vulnerability

Published Feb 21, 2005

Updated

misc.php for vBulletin 3.0.6 and earlier, when "Add Template Name in HTML Comments" is enabled, allows remote attackers to execute arbitrary PHP code via nested variables in the template parameter.

Affected Software

29 affected components

Jelsoft vBulletin=2.0

Jelsoft vBulletin=2.0.1

Jelsoft vBulletin=2.0.2

Jelsoft vBulletin=2.0_beta_2

Jelsoft vBulletin=2.0_beta_3

Jelsoft vBulletin=2.2.0

Jelsoft vBulletin=2.2.1

Jelsoft vBulletin=2.2.2

Jelsoft vBulletin=2.2.3

Jelsoft vBulletin=2.2.4

Jelsoft vBulletin=2.2.5

Jelsoft vBulletin=2.2.6

Jelsoft vBulletin=2.2.7

Jelsoft vBulletin=2.2.8

Jelsoft vBulletin=2.2.9_can

Jelsoft vBulletin=2.3.0

Jelsoft vBulletin=2.3.3

Jelsoft vBulletin=2.3.4

Jelsoft vBulletin=3.0.0

Jelsoft vBulletin=3.0.0_beta_2

Jelsoft vBulletin=3.0.0_can4

Jelsoft vBulletin=3.0.0_rc4

Jelsoft vBulletin=3.0.1

Jelsoft vBulletin=3.0.2

Jelsoft vBulletin=3.0.3

Jelsoft vBulletin=3.0.4

Jelsoft vBulletin=3.0.5

Jelsoft vBulletin=3.0.6

Jelsoft vBulletin=3.0_beta_2

Remediation

Patch Available

http://secunia.com/advisories/14326

Event History

Feb 21, 2005

CVE Published

05:00 AM

Feb 23, 2005

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2005-0511?

CVE-2005-0511 is considered a critical vulnerability due to its potential for remote code execution.

How do I fix CVE-2005-0511?

To fix CVE-2005-0511, upgrade vBulletin to version 3.0.7 or later, which addresses this vulnerability.

What versions of vBulletin are affected by CVE-2005-0511?

CVE-2005-0511 impacts vBulletin versions 3.0.6 and earlier, as well as earlier versions like 2.0 and 2.2 series.

Can CVE-2005-0511 allow an attacker to control my server?

Yes, CVE-2005-0511 can allow remote attackers to execute arbitrary PHP code, potentially giving them control over the server.

Is it necessary to disable features in vBulletin to mitigate CVE-2005-0511?

While upgrading is the best fix, temporarily disabling the "Add Template Name in HTML Comments" feature can help mitigate the risk associated with CVE-2005-0511.