CVE-2016-6195

Critical

Published: 30/08/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

CVE-2016-6195 is an SQL injection vulnerability in moderation.php in vBulletin before version 4.2.2 Patch Level 5 and 4.2.3 before Patch Level 1. It allows remote attackers to execute arbitrary SQL commands via the postids parameter in request.php.

Risk Assessment

Attackers can exploit this vulnerability to gain access to the database, potentially leading to data theft or system compromise. Exploiting this vulnerability in a production environment can have serious security implications for the organization.

Recommendation

It is recommended to update vBulletin to the latest version to mitigate this vulnerability. Additionally, conducting a security audit of the application is advisable to identify other potential threats.

Original NVD description (English source)

SQL injection vulnerability in forumrunner/includes/moderation.php in vBulletin before 4.2.2 Patch Level 5 and 4.2.3 before Patch Level 1 allows remote attackers to execute arbitrary SQL commands via the postids parameter to forumrunner/request.php, as exploited in the wild in July 2016.