CVE-2016-6195: vBulletin <= 4.2.3 - SQL Injection

HoneyLabs honeypots recorded 6 probes matching CVE-2016-6195 from 1 distinct source IP addresses in the last 7 days. Severity is rated critical.

Request paths that identify it

  • /forums/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27
  • /board/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27
  • /forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27
  • /vb/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27
  • /boards/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27
  • /forum/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27

Addresses probing it

Source IPProbesNetworkCountry
93.123.109.2146Techoff Srv LimitedBulgaria

Networks it comes from

ASNOrganisationProbesSource IPs
AS48090Techoff Srv Limited61

Captured requests

  • /vb/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27
  • /forum/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27
  • /forums/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27
  • /boards/forumrunner/request.php?d=1&cmd=get_spam_data&postids=-1%27

CVE report

CVE report

Open a specific CVE from the CVE tracker.