CVE-2019-16759
vBulletin PHP Module Remote Code Execution Vulnerability
Description
CVE-2019-16759 is a critical code injection vulnerability affecting vBulletin 5.x through 5.5.4. The vulnerability allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request, enabling unauthenticated attackers to execute arbitrary code on the server. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 94.43% (99.98th percentile), this vBulletin vulnerability has a near-certain probability of exploitation and represents an immediate threat to any unpatched vBulletin forum.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| vbulletin | vbulletin | >= 5.0.0, <= 5.5.4 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/154623/vBulletin-5.x-0-Day-Pre-Auth-Remote-Command-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/154648/vBulletin-5.x-Pre-Auth-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/155633/vBulletin-5.5.4-Remote-Command-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/158829/vBulletin-5.x-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/158830/vBulletin-5.x-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/158866/vBulletin-5.x-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://seclists.org/fulldisclosure/2020/Aug/5(Exploit, Mailing List, Third Party Advisory)
- https://arstechnica.com/information-technology/2019/09/public-exploit-code-spawns-mass-attacks-against-high-severity-vbulletin-bug/(Exploit, Press/Media Coverage, Third Party Advisory)
- https://seclists.org/fulldisclosure/2019/Sep/31(Exploit, Mailing List, Third Party Advisory)
- https://www.theregister.co.uk/2019/09/24/vbulletin_vbug_zeroday/(Press/Media Coverage, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-16759(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code (‘Code Injection’)
Code injection occurs when software constructs code segments using externally-influenced input without properly neutralizing special elements. In the case of CVE-2019-16759, the vBulletin PHP module accepts user-supplied code through the widgetConfig[code] parameter and executes it via the widget_php route, allowing attackers to inject and run arbitrary PHP code on the server with application-level privileges.
Learn more: CWE-94 — Improper Control of Generation of Code (‘Code Injection’)
Impact Analysis
CVE-2019-16759 carries a CVSS 3.1 score of 9.8 (CRITICAL), representing the highest practical severity rating. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication, and needs no user interaction. Successful exploitation fully compromises the confidentiality, integrity, and availability of the affected vBulletin server, granting the attacker the ability to execute arbitrary commands. The EPSS score of 94.43% places this vulnerability in the 99.98th percentile, indicating near-certain exploitation activity. Organizations running vulnerable vBulletin installations face critical risk of complete server compromise, data theft, and defacement of their community forums.
Exploit Maturity
Public exploit code is widely available for CVE-2019-16759, with multiple proof-of-concept exploits published via Packet Storm Security and additional variants at Packet Storm. The vulnerability was originally disclosed as a zero-day exploit, with mass exploitation campaigns reported shortly after disclosure. CISA has confirmed active exploitation in the wild through its KEV catalog. The EPSS score of 94.43% (99.98th percentile) indicates near-certain exploitation activity. This vulnerability was later found to have an incomplete patch, which was exploited through CVE-2020-17496 using a different request parameter.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Upgrade vBulletin to a version beyond 5.5.4 that fully addresses this code injection vulnerability.
- Verify that all vBulletin instances running versions 5.0.0 through 5.5.4 have been updated, and also address CVE-2020-17496 which exploits an incomplete fix for this vulnerability.
- Disable the PHP widget rendering functionality by removing or restricting access to the ajax/render/widget_php route if patching is not immediately possible.
- Deploy a web application firewall (WAF) rule to block requests containing widgetConfig[code] parameters targeting the widget_php routestring.
- Review server logs for indicators of compromise, specifically looking for requests to ajax/render/widget_php with widgetConfig parameters, and conduct forensic analysis if exploitation is detected.
Technical Details
CVE-2019-16759 is a code injection vulnerability in the vBulletin PHP widget rendering module. The vulnerability exists because the ajax/render/widget_php routestring handler accepts a widgetConfig[code] parameter containing arbitrary PHP code, which is then executed by the server without proper input validation or sanitization. This directly maps to CWE-94, where user-controlled input is passed to a code execution function without neutralization. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms that the attack is network-based, trivially exploitable, and requires no privileges or user interaction. The vulnerability was disclosed as a zero-day and its initial patch was incomplete, leading to CVE-2020-17496 which exploited a different parameter in the same subsystem.
Frequently Asked Questions
Is CVE-2019-16759 being actively exploited?
Yes. CVE-2019-16759 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. The EPSS score of 94.43% (99.98th percentile) indicates near-certain exploitation activity. Multiple public exploits are available, and mass exploitation campaigns were reported following its initial disclosure as a zero-day.
What products are affected by CVE-2019-16759?
CVE-2019-16759 affects vBulletin versions 5.0.0 through 5.5.4. All vBulletin 5.x installations within this version range are vulnerable to this remote code execution vulnerability through the PHP widget module.
How do I fix CVE-2019-16759?
Apply updates per vendor instructions by upgrading vBulletin beyond version 5.5.4. Ensure that the patch also addresses CVE-2020-17496, which exploits an incomplete fix. As an interim measure, block or disable the ajax/render/widget_php route and deploy WAF rules to filter widgetConfig[code] parameters.
How severe is CVE-2019-16759?
CVE-2019-16759 has a CVSS 3.1 score of 9.8 (CRITICAL). This is a maximum-severity vulnerability with near-certain exploitation probability (EPSS 94.43%) that enables unauthenticated remote code execution on affected vBulletin servers.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.