CVE-2014-2023

Critical

Published: 26/10/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The Tapatalk plugin versions 4.9.0 and earlier and 5.x through 5.2.1 for vBulletin contain multiple SQL injection vulnerabilities. Attackers can remotely execute arbitrary SQL commands via a crafted xmlrpc API request.

Risk Assessment

These vulnerabilities may lead to unauthorized access to the database, potentially resulting in data loss or modification. Organizations should be aware of the risks associated with using this plugin.

Recommendation

It is recommended to update the Tapatalk plugin to the latest version to mitigate the risks associated with these vulnerabilities. Additionally, monitoring server logs for potential attack attempts is advisable.

Original NVD description (English source)

Multiple SQL injection vulnerabilities in the Tapatalk plugin 4.9.0 and earlier and 5.x through 5.2.1 for vBulletin allow remote attackers to execute arbitrary SQL commands via a crafted xmlrpc API request to (1) unsubscribe_forum.php or (2) unsubscribe_topic.php in mobiquo/functions/.