Meta tags:

Headings (most frequently used words):

the, exploit, smartcast, exploiting, of, root, rooting, with, hacking, poc, python, cve, 2019, 16759, orp, open, research, project, viziown, vizio, platform, vbulletin, tale, patch, fail, firetv, cube, and, pendant, firefu, all, your, things, are, belong, to, us, western, digital, mycloud, nas, re, samsung, smartcam, gaining, on, google, onhub, in, support, legality, new, year, exploitee, rs, os, vulnerability, discovery, webservice, decompiled, manage, binary, beyond, appendix, code, problems, ahead, bypassing, full, slides, short, term, fix, rca, persistence, modification, ir, keymapping, json, update, bash, metasploit, module, recent, posts, archives, categories, other, models, same, different, payload, mt588x, web, interface, iwatch, install, php, command, execution, video,

Text of the page (most frequently used words):
the (614), and (202), this (111), for (89), template (79), with (77), our (76), that (74), #vbulletin (69), code (68), from (63), widgetconfig (49), can (46), php (46), are (44), data (44), user (43), new (42), which (40), file (39), ptbl_rsv (36), cmd (36), all (34), device (34), above (34), return (33), widget (33), not (32), install (32), raw (32), final_rendered (32), root (31), devices (31), ret (31), version (30), username (30), _output (30), you (29), within (29), command (29), will (28), was (28), widgetinstanceid (28), exploit (27), have (26), but (26), found (26), exploitee (25), name (25), use (25), html (25), self (25), then (24), div (24), these (23), vulnerability (23), tmp (23), google (22), login (22), function (22), your (21), other (21), upload (21), running (20), there (20), output (20), system (20), value (20), rsv (20), into (19), through (19), after (19), being (19), tar (19), array (19), empty (19), static (19), class (19), research (18), more (18), process (18), web (18), execution (18), includes (18), request (18), else (18), checksum (18), bin (18), vb5 (18), templates (18), subwidget (18), scpl (18), below (17), used (17), bugs (17), may (16), patch (16), time (16), few (16), content (16), onhub (16), emmc (16), error (16), subwidgets (16), config (16), vb5_connect (16), first (15), flash (15), comment (15), info (15), post (15), widget_php (15), body (15), scpl_tgz_package (15), things (14), open (14), now (14), exploiteers (14), released (14), one (14), wiki (14), boot (14), however (14), because (14), see (14), each (14), some (14), struct (14), buffer (14), size (14), _out (14), magic (14), logger (14), digital (13), hardware (13), remote (13), interface (13), out (13), exception (13), echo (13), check (13), var (13), import (13), curl (13), _file (13), protected (12), were (12), has (12), zenofex (12), posted (12), users (12), firmware (12), while (12), get (12), filename (12), set (12), any (12), cloud (12), following (12), path (12), lib (12), binary (12), variable (12), apt_err (12), goto (12), render (12), widget_tabbedcontainer_tab_panel (12), true (12), different (12), vb5_template_runtime (12), widgetid (12), can_use_sitebuilder (12), email (11), would (11), how (11), under (11), read (11), software (11), method (11), just (11), files (11), response (11), added (11), public (11), isset (11), exit (11), note (11), https (11), 7345 (11), western (10), 2011 (10), 2020 (10), same (10), could (10), its (10), filed (10), author (10), mode (10), usb (10), way (10), also (10), example (10), authentication (10), _request (10), _cookie (10), values (10), ssh (10), ajax (10), span (10), runtime (10), format (10), _extract_location (10), _cmd (10), scpl_root (10), uncategorized (9), gtvhacker (9), orp (9), when (9), simple (9), been (9), their (9), update (9), router (9), image (9), access (9), bug (9), number (9), write (9), mycloud (9), required (9), bypass (9), shell (9), provided (9), count (9), payload (9), def (9), try (9), eval (9), subprocess (9), _file_and_path (9), scpl_install (9), _continue (9), _log (9), json (9), sshd (9), script (9), updates (8), vizio (8), smartcast (8), hacking (8), here (8), look (8), something (8), today (8), only (8), line (8), they (8), both (8), key (8), what (8), find (8), url (8), server (8), supplied (8), input (8), samsung (8), scripts (8), vulnerabilities (8), injection (8), back (8), throw (8), like (8), normal (8), argument (8), wto (8), address (8), arguments (8), _session (8), two (8), offset (8), partitions (8), module (8), 2019 (8), end (8), analysis (8), condition (8), 4_patch_level_2 (8), 0500 (8), private (8), style (8), frontend (8), applicationlight (8), serverdata (8), _get (8), templatename (8), _run_cmd (8), scp (8), remount (8), 3rd_rw (8), lighttpd (8), nas (7), august (7), 2017 (7), belong (7), project (7), before (7), custom (7), network (7), android (7), make (7), smart (7), own (7), such (7), comments (7), created (7), recovery (7), had (7), page (7), well (7), previous (7), hack (7), able (7), allowed (7), defcon (7), need (7), admin (7), exec (7), since (7), binaries (7), logged (7), pre (7), allow (7), embedded (7), location (7), run (7), portion (7), sets (7), rendering (7), except (7), child (7), appears (7), result (7), _content (7), customers (7), installation (7), package (7), tgz (7), hulu (7), february (6), rooting (6), exploiting (6), platform (6), than (6), group (6), form (6), over (6), rest (6), know (6), developer (6), want (6), include (6), full (6), come (6), video (6), where (6), usage (6), ability (6), further (6), point (6), dump (6), along (6), multiple (6), currently (6), based (6), work (6), fix (6), most (6), last (6), vendor (6), community (6), quickly (6), index (6), target (6), handle (6), touch (6), cookies (6), isadmin (6), another (6), getting (6), reboot (6), ptbl (6), mmc (6), null (6), vpart (6), mmc_partitions_magic (6), faild (6), dfu (6), sys (6), python (6), bash (6), prevent (6), cve (6), 16759 (6), panel_id (6), route (6), diff (6), border (6), routeinfo (6), arrays (6), don (6), failure (6), logs (6), exc (6), discord (6), interesting (6), run_console_onoff (6), start (6), 106 (6), port (6), export (6), pythonpath (6), october (5), december (5), 2013 (5), firetv (5), firefu (5), fail (5), year (5), exploits (5), researchers (5), simply (5), chat (5), them (5), experience (5), off (5), chromebook (5), without (5), modified (5), booting (5), prior (5), chrome (5), having (5), going (5), app (5), including (5), board (5), did (5), available (5), modify (5), keys (5), instructions (5), camera (5), service (5), change (5), during (5), blackhat (5), general (5), product (5), functionality (5), allowing (5), non (5), login_check (5), prevented (5), actually (5), incorrect (5), checking (5), isn (5), variables (5), bit (5), giving (5), slides (5), auth (5), primitive (5), list (5), around (5), chain (5), tools (5), memory (5), sending (5), save (5), settings (5), poc (5), later (5), default (5), evalphp (5), malicious (5), solid (5), padding (5), action (5), pass (5), systempath (5), none (5), xvzf (5), please (5), cat (5), manage (5), restapp (5), fcgi (5), ld_library_path (5), apk (5), copyright (4), january (4), 2012 (4), 2015 (4), 2021 (4), site (4), working (4), popular (4), worked (4), until (4), years (4), named (4), locks (4), every (4), security (4), works (4), lot (4), ensure (4), technical (4), plan (4), contained (4), attack (4), secure (4), spi (4), remove (4), stored (4), contains (4), looking (4), talk (4), findings (4), everything (4), call (4), commands (4), previously (4), left (4), leveraged (4), entire (4), once (4), presentation (4), series (4), attempt (4), beyond (4), large (4), _files (4), execute (4), too (4), login_checker (4), quotes (4), resulting (4), using (4), problem (4), escapeshellcmd (4), intended (4), does (4), therefore (4), wto_check (4), presentations (4), even (4), application (4), providing (4), specifically (4), table (4), overflow (4), needs (4), exploitation (4), int (4), sizeof (4), 512 (4), environment (4), hdmi (4), click (4), edit (4), keep (4), rce (4), argparse (4), requests (4), run_exploit (4), vb_loc (4), shell_cmd (4), post_data (4), args (4), print (4), str (4), filtering (4), templatetype (4), date (4), alpha (4), cdata (4), create (4), tabbedcontainersubmodules (4), issues (4), still (4), type (4), insecure (4), fetchconfig (4), show_at_breakpoints_css_classes (4), canvas (4), widget_ (4), instance (4), module_title (4), show_title_divider (4), disable_php_rendering (4), click_edit_to_config_module (4), anything (4), potentially (4), phpeval (4), currenttemplate (4), 10px (4), changes (4), 286 (4), vb5_frontend_routing (4), setrouteinfo (4), actionrender (4), fine (4), setting (4), query (4), params (4), queryparameters (4), api_interfaceabstract (4), setlight (4), vb5_template (4), staticrenderajax (4), sendasjson (4), disallowednames (4), unset (4), false (4), background (4), color (4), top (4), scpl_tmp (4), mkdir (4), raise (4), download_location (4), extract_location (4), crackle (4), button (4), via (4), xumo (4), leveraging (4), extracting (4), webserver (4), handler (4), ssl (4), test (4), scan (4), bot (4), revue (3), april (3), july (3), 2014 (3), 2018 (3), cube (3), pendant (3), tale (3), happy (3), ever (3), future (3), items (3), forward (3), finally (3), next (3), free (3), let (3), started (3), who (3), met (3), goal (3), utilizing (3), began (3), situation (3), place (3), mobile (3), submitted (3), formally (3), tvs (3), support (3), apps (3), might (3), reasons (3), made (3), valid (3), others (3), awesome (3), control (3), believe (3), roots (3), details (3), visit (3), attempts (3), looked (3), hidden (3), switch (3), docs (3), pressing (3), extension (3), easy (3), initial (3), attacks (3), those (3), flashing (3), debug (3), images (3), quick (3), depth (3), short (3), unfortunately (3), provides (3), about (3), iwatch (3), exploited (3), sanitization (3), smartcam (3), removed (3), patched (3), provide (3), visiting (3), session (3), administrator (3), locally (3), accessible (3), blog (3), vegas (3), online (3), instead (3), hoping (3), possible (3), fixed (3), contents (3), fwrite (3), onto (3), executed (3), mentioned (3), done (3), cookie (3), cases (3), string (3), escape (3), attacker (3), break (3), add (3), ourselves (3), original (3), storage (3), reader (3), hope (3), latest (3), attendees (3), received (3), store (3), given (3), needed (3), enough (3), 490 (3), heap (3), ran (3), area (3), unsigned (3), much (3), soc (3), kernel (3), leverage (3), partition (3), directly (3), i2c (3), arduino (3), perform (3), safe (3), metasploit (3), text (3), help (3), written (3), features (3), show (3), seem (3), approach (3), focus (3), modifying (3), doing (3), making (3), 1px (3), red (3), cleanregistered (3), registered (3), internal (3), relevant (3), proof (3), concept (3), rest_framework (3), property (3), _style (3), _install_script (3), handle_uploaded_file (3), check_output (3), replace (3), fileto (3), lets (3), push (3), mount (3), xml (3), actual (3), services (3), play (3), busyboxv7 (3), busybox (3), expect (3), launch (3), testing (3), model (3), models (3), sx7 (3), enable (3), filesystem (3), strings (3), vzservices (3), bluetooth (3), basedir (3), directory (3), browser (3), nmap (3), ports (3), bots (3), apks (3), sony (2), routers (2), netgear (2), logitech (2), june (2), march (2), viziown (2), recent (2), older (2), entries (2), tldr (2), decided (2), days (2), changing (2), happen (2), right (2), forum (2), newly (2), purchased (2), never (2), thought (2), internet (2), 31st (2), tags (2), view (2), day (2), jailbreaking (2), streaming (2), media (2), legal (2), choose (2), mechanism (2), circumvent (2), aren (2), exemption (2), three (2), proposed (2), exemptions (2), good (2), thing (2), modifications (2), rooted (2), 9th (2), legality (2), deeper (2), bottom (2), soon (2), determine (2), special (2), comb (2), chromiumos (2), ctrl (2), crafted (2), attempted (2), reading (2), involved (2), bios (2), crippled (2), apart (2), took (2), proceeded (2), raspberry (2), highly (2), very (2), close (2), main (2), search (2), radio (2), speaker (2), pieces (2), eye (2), low (2), bus (2), releasing (2), engineered (2), involves (2), loading (2), disk (2), reverse (2), runs (2), enabling (2), panel (2), updated (2), 404 (2), backend (2), monitoring (2), audit (2), verifying (2), demo (2), follow (2), complete (2), ex2 (2), pr4100 (2), gen (2), products (2), normally (2), properly (2), pwnie (2), responsible (2), disclosure (2), facing (2), portions (2), patches (2), listed (2), severe (2), means (2), consists (2), checks (2), called (2), retrieve (2), uploaded (2), preg_match (2), str_replace (2), folder (2), tmp_name (2), addons (2), specific (2), authenticated (2), think (2), basic (2), pattern (2), many (2), case (2), executes (2), local (2), obtain (2), calls (2), little (2), consider (2), allows (2), although (2), should (2), escapeshellarg (2), filter (2), independent (2), opposed (2), login_status (2), www (2), returned (2), otherwise (2), current (2), verify (2), requirements (2), uses (2), came (2), adding (2), enabled (2), sdcard (2), thank (2), round (2), boards (2), card (2), order (2), qnap (2), home (2), controller (2), chromecast (2), pages (2), interested (2), present (2), amazing (2), conferences (2), source (2), img (2), high (2), due (2), must (2), 436 (2), 437 (2), get_ptbl_rsv (2), _iptbl (2), 438 (2), 439 (2), 440 (2), uchar (2), 441 (2), ulong (2), 442 (2), 443 (2), virtual_partition (2), aml_get_virtual_partition_by_name (2), mmc_table_name (2), 444 (2), 445 (2), 511 (2), 446 (2), 447 (2), partitons (2), 448 (2), 449 (2), 450 (2), 451 (2), malloc (2), 452 (2), 453 (2), 454 (2), 455 (2), 456 (2), 457 (2), 458 (2), _get_inherent_offset (2), mmc_reserved_name (2), 459 (2), _mmc_rsv_read (2), 460 (2), failed (2), 461 (2), 462 (2), 463 (2), 464 (2), 465 (2), 466 (2), apt_info (2), 467 (2), 468 (2), fixme (2), 469 (2), strcmp (2), 470 (2), 471 (2), 472 (2), 473 (2), 474 (2), 475 (2), _get_version (2), 476 (2), 477 (2), 478 (2), 479 (2), 480 (2), 481 (2), sum (2), 482 (2), _calc_iptbl_check (2), 483 (2), 484 (2), 485 (2), 486 (2), 487 (2), 488 (2), 489 (2), memcpy (2), 491 (2), 492 (2), 493 (2), 494 (2), 495 (2), 496 (2), perfect (2), consisted (2), triggered (2), seen (2), primitives (2), connecting (2), pins (2), loaded (2), side (2), likely (2), warning (2), disable (2), pushing (2), pull (2), usr (2), env (2), python3 (2), widget_tabbedcontainer (2), shell_exec (2), argumentparser (2), description (2), add_argument (2), parse_args (2), vbulletin5 (2), keyboardinterrupt (2), 0day (2), urlencode (2), perl (2), muri (2), chomp (2), uri_escape (2), send (2), 20shell_exec (2), http (2), com (2), phpinfo (2), simplicity (2), taking (2), load (2), controlled (2), displayed (2), bypassing (2), 1532130449 (2), concat (2), id_prefix (2), tab_num (2), clearfix (2), tabs (2), hide (2), widgettitle (2), title (2), nbsp (2), parent (2), situations (2), included (2), constant (2), rendered (2), parsedata (2), vbvar (2), includetemplate (2), getdatastore (2), getoption (2), parsephrase (2), 1569453621 (2), vboptions (2), outside (2), phrase (2), engine (2), take (2), problems (2), 276913797 (2), 493511575 (2), ugly (2), shouldn (2), lightly (2), widely (2), uglier (2), starttemplate (2), array_push (2), endtemplate (2), array_pop (2), units (2), 1944 (2), 1964 (2), margin (2), htmlspecialchars (2), timername (2), elapsed (2), prevents (2), ob_start (2), ob_get_contents (2), ob_end_clean (2), second (2), part (2), 356918994 (2), 577517014 (2), vb5_exception_api (2), invalid_request (2), css_links (2), between (2), doesn (2), problematic (2), unnecesary (2), copies (2), alternative (2), reference (2), causes (2), headaches (2), foreach (2), globalregistered (2), 123 (2), shown (2), labeled (2), september (2), liner (2), uncompyle6 (2), statichtmlrenderer (2), apiview (2), conf (2), logging (2), is_tv_in_device_group (2), global (2), _storedscdevice (2), head (2), collapse (2), ddd (2), 12px (2), 2px (2), _body (2), thead (2), tbody (2), _response (2), install_script (2), stderr (2), stdout (2), universal_newlines (2), calledprocesserror (2), destination (2), chunk (2), mod (2), codes (2), grab (2), misc (2), editor (2), keymapping (2), per (2), why (2), prefer (2), hands (2), question (2), modification (2), watch (2), persist (2), extra (2), pop (2), telnetd (2), 1337 (2), xfv (2), executing (2), stack (2), daemon (2), mt588x (2), ipv4 (2), wrong (2), goes (2), types (2), etc (2), library (2), locate (2), proceeds (2), passes (2), 00000000 (2), 00000010 (2), 00000020 (2), 00000030 (2), 00000040 (2), 00000050 (2), pyc (2), invoked (2), logwrapper (2), pem (2), digging (2), inside (2), earlier (2), detection (2), scanning (2), great (2), fact (2), ecosystem (2), chromium (2), addition (2), common (2), exploiteer (2), iot (2), ago (2), results (2), projects (2), idea (2), fuzzing (2), performing (2), analyze (2), tooling (2), 2026, rights, reserved, roku, nest, hisense, kernels, asus, categories, november, archives, posts, storefront, sell, mean, retire, transition, transitioning, logos, themes, archived, stay, notice, feel, contact, wanted, heavily, fortified, turn, moved, irc, relay, channel, researching, better, eventually, turned, obsession, irony, period, itself, ditched, guaranteeing, entry, pdf, people, encounter, kind, advocate, stating, players, strongly, watching, whatever, pesky, laws, governing, criminalizes, breaking, electronic, copyrighted, authors, law, recognized, infringement, recognize, happens, office, evaluating, category, freedom, conservancy, millenium, act, convinced, continue, hacks, participating, political, united, states, tirelessly, sorts, hans, procedure, heart, screen, subsequent, game, packaged, comparison, plate, screw, enables, requires, sequence, hitting, switches, examining, creator, major, breakthrough, entailed, exploring, teamed, helped, feasibility, stated, setup, chromeos, physical, receiving, acquired, went, tearing, flashrom, dumping, compare, determined, resembled, match, architecture, spent, dumps, determining, sights, aimed, intention, real, radios, unused, zigbee, plethora, antennas, caught, ics, knew, voltage, adapters, pirate, stuck, ifixit, teardown, reversed, resign, development, disassembly, 8th, maximus, gaining, crafting, passed, inject, achieve, demonstration, writeup, smartcams, administration, visits, greeted, message, configure, completely, seemingly, abilities, webcam, untouched, contain, unprivileged, hacked, arbitrarily, password, alerted, reacted, removing, requiring, website, angered, diy, solutions, give, cameras, smartcloud, 14th, alerts, twitter, listing, small, dl4100, dl2100, ex4100, ex2100, ex4, ultra, pr2100, mirror, applied, scope, reached, arbitrary, unauthenticated, statistics, vendors, learned, reputation, particular, won, lamest, ignored, severity, reported, ignoring, leave, vulnerable, longer, periods, attempting, alert, flaws, networks, limiting, wherever, fully, disclosing, expedites, awards, evaluate, move_uploaded_file, fopen, txt, fclose, sleep, json_encode, ftp_download, errors, commented, errata, encapsulated, double, commandhere, syntax, times, restriction, overcome, important, turns, existing, assigns, superglobal, indexes, immediately, majority, wdcloud, handled, cgi, formatted, handles, encapsulating, log, already, timeout, sufficient, programmer, wrote, least, sprintf, _server, remote_addr, client, hasn, timed, indicating, writing, rolled, patching, introduced, consequences, supplying, specially, privileged, paths, fails, sessions, summed, follows, shocked, performed, necessarily, bad, examine, middle, decoding, prefered, player, plex, ordered, recommended, friend, grew, weary, proper, ometimes, fun, sometimes, latter, networked, attached, 4th, attended, either, say, coming, enjoyed, hear, didn, videos, love, spend, inspire, recently, particularly, micro, breakout, readers, logic, sale, away, orders, front, dropped, audience, highlights, affects, transcoding, past, anywhere, paired, unfixed, documented, uart, affecting, sdk, dozens, zmodo, greet, cjaed, lutron, bdg2, caseta, bridge, linksys, wrt1200ac, vudu, spark, bpm350, p602ui, ggmm, veraedge, link, dcs, 936l, tenvis, t8810, cujo, m3320nd, sdr, 3102n, belkin, n300, turbostation, amazon, tap, wn3000rp, aluratek, wifi, muzo, cobblestone, aobo, spy, 720p, corresponding, material, showcased, variety, geared, toward, strategy, attacking, showed, identify, pinouts, tips, connect, standard, wires, subject, white, paper, reflect, las, opportunity, usa, presented, engineering, remake, grateful, letting, summary, revealed, hopefully, guide, visitors, stuff, 18th, planet, information, simplify, chosen, flashboot, fixups, magisk, facilitate, fastboot, allocation, tricking, believing, unlocked, disabling, signature, verification, move, old, fixup, addresses, pointing, successful, fire, rom, modules, weakness, boots, trust, stumbled, upon, accessing, registers, unable, discover, relies, amlogic, s905z, accessed, adapter, enters, cutting, cable, purchasing, header, appropriate, compatible, sketch, compiled, entering, remind, unofficial, risk, void, warranty, hello, halloween, fellow, excited, bringing, months, introducing, unlock, godspeed, yes, menu, options, dropdown, widgets, forums, term, published, framework, nclosing, closing, payloads, languages, ruby, creating, characteristics, effectively, loads, separately, placing, assistant, sections, thorough, somewhat, sighted, faces, encountering, checked, routestring, cleans, remedied, lucky, solution, manifesting, cannot, optimal, leading, declared, xss, nightmares, escaped, filtered, regardless, ways, innocuous, untrained, opens, pushed, arises, structured, language, processed, standalone, item, nested, ahead, layer, redundancy, incorrectly, third, statement, css, functioning, state, widget_rendering, iterates, deleting, single, obtained, coded, bases, versions, pulled, level, 120, 121, 122, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, issued, seemed, finder, inadequate, blocking, bugdoor, marked, critical, rating, cvss, score, broker, undisclosed, researcher, renderers, views, utils, django, getlogger, __name__, renderer_classes, resources, storagemanager, getproperty, __scgroup, proxy_test, font, family, arial, helvetica, sans, serif, width, 8px, nth, f2f2f2, hover, align, center, e4f2c1, black, orange, float, colspan, enctype, multipart, submit, soft, power, cycle, chunks, appendix, plenty, ideas, additions, share, simplest, swap, 0xf8, 0xf9, swapping, reason, virtualinputs, watchfree, replaced, appid, relates, indexed, links, encrypted, blobs, aws, secret, htmlappuri, exploration, makes, easier, remapping, cleaner, really, redirect, increase, overwritten, favorite, alter, peeking, mapped, 0x100090, fairly, straight, tackle, remappings, approaches, mapping, apparently, wikipedia, american, television, owned, telecommunications, conglomerate, comcast, heard, rumor, pay, press, hell, doom, webpages, mostly, automatic, recognition, acr, mine, sent, pain, points, thoughts, answer, nothing, killer, space, often, reconnect, endings, copy, persistence, affected, differing, stacks, best, pwd, chmod, 777, net, downloads, armv7l, telnet, download, mt5581, identified, mt5581vhbj, tweak, extract, exist, deliver, riptide_wave, d32f, tested, pq65, reliably, tweaked, build, prop, grep, fingerprint, automagical, linked, resistant, interactive, manually

Text of the page (random words):
x filed under uncategorized 1 comment on september 23 2019 an undisclosed researcher released a bug which allowed for php remote code execution in vbulletin 5 0 through 5 4 this bug cve 2019 16759 was labeled as a bugdoor because of its simplicity by a popular vulnerability broker and was marked with a cvss 3 x score of 9 8 giving it a critical rating today we re going to talk about how the patch that was supplied for the vulnerability was inadequate in blocking exploitation show how to bypass the resulting fix and releasing a bash one liner resulting in remote code execution in the latest vbulletin software cve 2019 16759 the vulnerability mentioned above was later formally labeled cve 2019 16759 and a patch was issued on september 25 2019 although the patch was provided in just under 3 days the patch seemed at the time to fix the proof of concept exploit provided by the un named finder the patch s consisted of three main changes provided in 2 sets of patches the first being shown below 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 remove any problematic values from the template variable arrays before rendering for now don t pass the values through these arrays are potentially large and we don t want to make unnecesary copies the alternative is to pass by reference which causes it s own headaches it s an internal function and the relevant arrays are all class variables private function cleanregistered disallowednames array widgetconfig foreach disallowednames as name unset this registered name unset self globalregistered name remove any problematic values from the template variable arrays before rendering for now don t pass the values through these arrays are potentially large and we don t want to make unnecesary copies the alternative is to pass by reference which causes it s own headaches it s an internal function and the relevant arrays are all class variables private function cleanregistered disallowednames array widgetconfig foreach disallowednames as name unset this registered name unset self globalregistered name the above function was added but unfortunately had to be obtained from the code as opposed to directly from a diff between the two coded bases this is because vbulletin doesn t provide the older insecure versions of their software after a patch is released therefore the above code was pulled directly from 5 5 4 patch level 2 the above cleanregistered function was added as the first fix to the vulnerability and simply iterates through a list of non allowed registered variables deleting their contents when found this list when added only contained the name of the single variable which contained the php code to execute in the released exploit in the next version of the software vbulletin 5 5 5 the following pieces were added to further prevent future problems with the widget_rendering template code 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 diff ur vbulletin vbulletin vb5_connect vbulletin 5 5 4_patch_level_2 upload includes vb5 frontend applicationlight php vbulletin vbulletin vb5_connect vbulletin 5 5 5 upload includes vb5 frontend applicationlight php vbulletin vbulletin vb5_connect vbulletin 5 5 4_patch_level_2 upload includes vb5 frontend applicationlight php 2020 08 08 06 40 31 356918994 0500 vbulletin vbulletin vb5_connect vbulletin 5 5 5 upload includes vb5 frontend applicationlight php 2020 08 08 06 40 40 577517014 0500 286 20 286 32 throw new vb5_exception_api ajax render array invalid_request this router new vb5_frontend_routing this router setrouteinfo array action actionrender arguments serverdata template routeinfo 2 this use of _get appears to be fine since it s setting the route query params not sending the data to the template render queryparameters _get api_interfaceabstract setlight templatename routeinfo 2 if templatename widget_php result array template css_links array else this router new vb5_frontend_routing this router setrouteinfo array action actionrender arguments serverdata template templatename this use of _get appears to be fine since it s setting the route query params not sending the data to the template render queryparameters _get api_interfaceabstract setlight result vb5_template staticrenderajax templatename serverdata this sendasjson vb5_template staticrenderajax routeinfo 2 serverdata this sendasjson result diff ur vbulletin vbulletin vb5_connect vbulletin 5 5 4_patch_level_2 upload includes vb5 frontend applicationlight php vbulletin vbulletin vb5_connect vbulletin 5 5 5 upload includes vb5 frontend applicationlight php vbulletin vbulletin vb5_connect vbulletin 5 5 4_patch_level_2 upload includes vb5 frontend applicationlight php 2020 08 08 06 40 31 356918994 0500 vbulletin vbulletin vb5_connect vbulletin 5 5 5 upload includes vb5 frontend applicationlight php 2020 08 08 06 40 40 577517014 0500 286 20 286 32 throw new vb5_exception_api ajax render array invalid_request this router new vb5_frontend_routing this router setrouteinfo array action actionrender arguments serverdata template routeinfo 2 this use of _get appears to be fine since it s setting the route query params not sending the data to the template render queryparameters _get api_interfaceabstract setlight templatename routeinfo 2 if templatename widget_php result array template css_links array else this router new vb5_frontend_routing this router setrouteinfo array action actionrender arguments serverdata template templatename this use of _get appears to be fine since it s setting the route query params not sending the data to the template render queryparameters _get api_interfaceabstract setlight result vb5_template staticrenderajax templatename serverdata this sendasjson vb5_template staticrenderajax routeinfo 2 serverdata this sendasjson result this portion of the patch created an if statement that would return empty template or css data if the widget_php template was listed as the last portion of the route these two changes prevented the poc from functioning in its released state the third change can be found in the second part of the vbulletin 5 5 5 update diff 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 diff ur vbulletin vbulletin vb5_connect vbulletin 5 5 4_patch_level_2 upload includes vb5 template runtime php vbulletin vbulletin vb5_connect vbulletin 5 5 5 upload includes vb5 template runtime php vbulletin vbulletin vb5_connect vbulletin 5 5 4_patch_level_2 upload includes vb5 template runtime php 2020 08 08 06 40 31 276913797 0500 vbulletin vbulletin vb5_connect vbulletin 5 5 5 upload includes vb5 template runtime php 2020 08 08 06 40 40 493511575 0500 12 6 12 26 class vb5_template_runtime this is intended to allow the runtime to know that template it is rendering it s ugly and shouldn t be used lightly but making some features widely available to all templates is uglier private static templates array public static function starttemplate template array_push self templates template public static function endtemplate array_pop self templates private static function currenttemplate return end self templates public static units array px 1944 6 1964 21 return div style border 1px solid red padding 10px margin 10px htmlspecialchars timername elapsed div public static function evalphp code only allow the php widget template to do this this prevents a malicious user from hacking something into a different template if self currenttemplate widget_php return ob_start eval code output ob_get_contents ob_end_clean return output diff ur vbulletin vbulletin vb5_connect vbulletin 5 5 4_patch_level_2 upload includes vb5 template runtime php vbulletin vbulletin vb5_connect vbulletin 5 5 5 upload includes vb5 template runtime php vbulletin vbulletin vb5_connect vbulletin 5 5 4_patch_level_2 upload includes vb5 template runtime php 2020 08 08 06 40 31 276913797 0500 vbulletin vbulletin vb5_connect vbulletin 5 5 5 upload includes vb5 template runtime php 2020 08 08 06 40 40 493511575 0500 12 6 12 26 class vb5_template_runtime this is intended to allow the runtime to know that template it is rendering it s ugly and shouldn t be used lightly but making some features widely available to all templates is uglier private static templates array public static function starttemplate template array_push self templates template public static function endtemplate array_pop self templates private static function currenttemplate return end self templates public static units array px 1944 6 1964 21 return div style border 1px solid red padding 10px margin 10px htmlspecialchars timername elapsed div public static function evalphp code only allow the php widget template to do this this prevents a malicious user from hacking something into a different template if self currenttemplate widget_php return ob_start eval code output ob_get_contents ob_end_clean return output this portion was added as a layer of redundancy to attempt to prevent any non widget_php template from loading the eval code based on the comment in the code this is an attempt to prevent a user from modifying a template to incorrectly call the evalphp without doing so from an embedded php widget problems ahead the problem with the above arises because of how the vbulletin template system is structured specifically templates aren t actually written in php but instead are written in a language that is first processed by the template engine and then is output as a string of php code that is later ran through an eval during the rendering process templates are also not a standalone item but can be nested within other templates in that one template can have a number of child templates embedded within for example take the following template 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 template name widget_php templatetype template date 1569453621 username vbulletin version 5 5 5 alpha 4 cdata vb if condition empty widgetconfig and empty widgetinstanceid vb data widgetconfig widget fetchconfig vb raw widgetinstanceid vb if vb if condition empty widgetconfig vb set widgetid vb raw widgetconfig widgetid vb set widgetinstanceid vb raw widgetconfig widgetinstanceid vb if div class b module vb var widgetconfig show_at_breakpoints_css_classes canvas widget default widget custom html widget id widget_ vb raw widgetinstanceid data widget id vb raw widgetid data widget instance id vb raw widgetinstanceid vb template module_title widgetconfig vb raw widgetconfig show_title_divider 1 can_use_sitebuilder vb raw user can_use_sitebuilder div class widget content vb if condition empty widgetconfig code and vboptions disable_php_rendering vb comment do not eval anything other than the widgetconfig code anything else could potentially come from a malicious user do not use phpeval outside of this template ever vb comment vb phpeval vb raw widgetconfig code vb else vb if condition user can_use_sitebuilder span class note vb phrase click_edit_to_config_module span vb if vb if div div template template name widget_php templatetype template date 1569453621 username vbulletin version 5 5 5 alpha 4 cdata vb if condition empty widgetconfig and empty widgetinstanceid vb data widgetconfig widget fetchconfig vb raw widgetinstanceid vb if vb if condition empty widgetconfig vb set widgetid vb raw widgetconfig widgetid vb set widgetinstanceid vb raw widgetconfig widgetinstanceid vb if div class b module vb var widgetconfig show_at_breakpoints_css_classes canvas widget default widget custom html widget id widget_ vb raw widgetinstanceid data widget id vb raw widgetid data widget instance id vb raw widgetinstanceid vb template module_title widgetconfig vb raw widgetconfig show_title_divider 1 can_use_sitebuilder vb raw user can_use_sitebuilder div class widget content vb if condition empty widgetconfig code and vboptions disable_php_rendering vb comment do not eval anything other than the widgetconfig code anything else could potentially come from a malicious user do not use phpeval outside of this template ever vb comment vb phpeval vb raw widgetconfig code vb else vb if condition user can_use_sitebuilder span class note vb phrase click_edit_to_config_module span vb if vb if div div template this template would be rendered to the following php code 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 final_rendered if empty widgetconfig and empty widgetinstanceid final_rendered r n t widgetconfig vb5_template_runtime parsedata widget fetchconfig widgetinstanceid final_rendered r n n t t t t else final_rendered final_rendered r n r n if empty widgetconfig final_rendered r n t widgetid widgetconfig widgetid final_rendered r n t widgetinstanceid widgetconfig widgetinstanceid final_rendered r n n t t t t else final_rendered final_rendered r n r n div class b module vb5_template_runtime vbvar widgetconfig show_at_breakpoints_css_classes canvas widget default widget custom html widget id widget_ widgetinstanceid data widget id widgetid data widget instance id widgetinstanceid r n r n t vb5_template_runtime includetemplate module_title array widgetconfig widgetconfig show_title_divider 1 can_use_sitebuilder user can_use_sitebuilder r n r n t div class widget content r n t t if empty widgetconfig code and vb getdatastore getoption disable_php_rendering final_rendered r n t t t r n t t t vb5_template_runtime evalphp widgetconfig code r n t t else final_rendered r n t t t if user can_use_sitebuilder final_rendered r n t t t t span class note vb5_template_runtime parsephrase click_edit_to_config_module span r n t t t else final_rendered final_rendered r n t t final_rendered r n t div r n div final_rendered if empty widgetconfig and empty widgetinstanceid final_rendered r n t widgetconfig vb5_template_runtime parsedata widget fetchconfig widgetinstanceid final_rendered r n n t t t t else final_rendered final_rendered r n r n if empty widgetconfig final_rendered r n t widgetid widgetconfig widgetid final_rendered r n t widgetinstanceid widgetconfig widgetinstanceid final_rendered r n n t t t t else final_rendered final_rendered r n r n div class b module vb5_template_runtime vbvar widgetconfig show_at_breakpoints_css_classes canvas widget default widget custom html widget id widget_ widgetinstanceid data widget id widgetid data widget instance id widgetinstanceid r n r n t vb5_template_runtime includetemplate module_title array widgetconfig widgetconfig show_title_divider 1 can_use_sitebuilder user can_use_sitebuilder r n r n t div class widget content r n t t if empty widgetconfig code and vb getdatastore getoption disable_php_rendering final_rendered r n t t t r n t t t vb5_template_runtime evalphp widgetconfig code r n t t else final_rendered r n t t t if user can_use_sitebuilder final_rendered r n t t t t span class note vb5_templ...