Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

vBulletin 3.0.7 lets attackers run database commands

CVE-2005-3024 · published 21 years ago
Summary

Older versions of the vBulletin forum software let a remote user send specially crafted web requests that cause the database to execute unintended commands. This can lead to data theft, alteration, or removal. Update to a newer, patched version of vBulletin or apply the vendor’s security updates as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
jelsoft vbulletin 1.0.1
2.0.3
2.0_rc2
2.0_rc3
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
21 more version ranges
cpe:2.3:a:jelsoft:vbulletin:1.0.1:*:lite:*:*:*:*:*
Original advisory text
Multiple SQL injection vulnerabilities in vBulletin 3.0.7 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) announcement parameter to announcement.php, the (2) thread...
Multiple SQL injection vulnerabilities in vBulletin 3.0.7 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) announcement parameter to announcement.php, the (2) thread[forumid] or (3) criteria parameters to thread.php, (4) userid parameter to user.php, the (5) calendarcustomfieldid, (6) calendarid, (7) moderatorid, (8) holidayid, (9) calendarmoderatorid, or (10) calendar[0] parameters to admincalendar.php, (11) the cronid parameter to cronlog.php, (12) user[usergroupid][0] parameter to email.php, (13) help[0] parameter to help.php, the (14) limitnumber or (15) limitstart parameter to user.php, the (16) usertitleid or (17) ids parameters to usertitle.php, (18) rvt[0] parameter to language.php, (19) keep[0] parameter to phrase.php, (20) dostyleid parameter to template.php, (21) thread[forumid] parameter to thread.php, or (22) usertools.php.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
1% chance of attack within 30 days
Timeline
Published21 Sep 2005
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2005-3024 · NVD
Track software like this
Free during beta