# Exploit Title: vBulletin Moderator Control Panel CSRF # Google Dork: "Powered by vBulletin® Version 4.2.2" # Date: 16-12-2014 # Exploit Author: Tomescu Daniel http://daniel-tomescu.com https://rstforums.com/forum # Vendor Homepage: http://www.vbulletin.com/en/vb4-features/ # Software Link: Premium # Version: vBulletin 4.2.2 # Tested on: Chrome and Firefox # Reference: https://rstforums.com/forum/88810-csrf-vbulletin-modcp.rst ### 1. Description vBulletin Moderator Control Panel suffer from a CSRF vulnerability because the CSRF tokens "adminhash" and "securitytoken" are not verified in POST requests. vBulletin has one additional protection against CSRF: checking the Referer header to be same origin. However this can be bypassed by making a POST request that does not have a Referer header. This vulnerability allows an attacker to ban/unban users, to modify user profiles, to edit/approve posts and topics and so on. ### 2. Proof of Concept The attacker should target a moderator of target-forum.com and the moderator must be logged in Moderator Control Panel. The vulnerability can be exploited by tricking the moderator to visit a webpage that contains the following html code: As a result, the user with the username "UserToBeBanned" will be added to the banned users list. ### 3. Solution: Do not allow POST requests without a Referer header. Verify "adminhash" and "securitytoken" to be valid.