Vulnerability Details : CVE-2020-12720

Exploit prediction scoring system (EPSS) score for CVE-2020-12720

Metasploit modules for CVE-2020-12720

• vBulletin /ajax/api/content_infraction/getIndexableContent nodeid Parameter SQL Injection

  Disclosure Date: 2020-03-12

  First seen: 2020-06-02

  auxiliary/gather/vbulletin_getindexablecontent_sqli

  This module exploits a SQL injection vulnerability found in vBulletin 5.x.x to dump the user table information or to dump all of the vBulletin tables (based on the selected options). This module has been tested successfully on VBulletin Version 5.6.1 on Ubuntu Linux.

  More information

• vBulletin /ajax/api/content_infraction/getIndexableContent nodeid Parameter SQL Injection

  Disclosure Date: 2020-03-12

  First seen: 2020-06-02

  exploit/multi/http/vbulletin_getindexablecontent

  This module exploits a SQL injection vulnerability found in vBulletin 5.6.1 and earlier This module uses the getIndexableContent vulnerability to reset the administrators password, it then uses the administrators login information to achieve RCE on the target. This mod

  More information

CVSS scores for CVE-2020-12720

CWE ids for CVE-2020-12720

• CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
  The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.
  Assigned by: nvd@nist.gov (Primary)
• CWE-306 Missing Authentication for Critical Function
  The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
  Assigned by: nvd@nist.gov (Primary)

References for CVE-2020-12720

Products affected by CVE-2020-12720