CVE-2017-17671
CriticalSummary
vBulletin versions up to 5.3.x on Windows allows remote PHP code execution due to the accessibility of a require_once call with an unauthenticated request that can include directory traversal sequences to specify an arbitrary pathname. The blocking of ../ traversal does not apply to ..\, allowing for exploitation of this vulnerability.
Risk Assessment
An attacker can exploit this vulnerability to execute malicious code on the server, potentially leading to system takeover or data leakage. Organizations should be aware of the risks associated with unauthorized access to system files.
Recommendation
It is recommended to update vBulletin to the latest version to eliminate this vulnerability. Additionally, implementing security mechanisms to prevent unauthorized file access and monitoring server logs for suspicious activities is advisable.
Original NVD description (English source)
vBulletin through 5.3.x on Windows allows remote PHP code execution because a require_once call is reachable with an unauthenticated request that can include directory traversal sequences to specify an arbitrary pathname, and because ../ traversal is blocked but ..\ traversal is not blocked. For example, an attacker can make an invalid HTTP request containing PHP code, and then make an index.php?routestring= request with enough instances of ".." to reach an Apache HTTP Server log file.