{"uuid": "e3fc0ebc-99e1-4e9e-b437-b06ee8c2b0ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-12720", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/vbulletin_getindexablecontent.rb", "content": "{\"aliases\": [], \"arch\": \"php\", \"author\": [\"Charles Fol \", \"Zenofex \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a SQL injection vulnerability found in vBulletin 5.6.1 and earlier\\n          This module uses the getIndexableContent vulnerability to reset the administrators password,\\n          it then uses the administrators login information to achieve RCE on the target. This module\\n          has been tested on VBulletin Version 5.6.1 on Ubuntu Linux distribution.\", \"disclosure_date\": \"2020-03-12\", \"fullname\": \"exploit/multi/http/vbulletin_getindexablecontent\", \"is_install_path\": true, \"mod_time\": \"2026-07-29 22:34:52 +0000\", \"name\": \"vBulletin /ajax/api/content_infraction/getIndexableContent nodeid Parameter SQL Injection\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"config-changes\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/vbulletin_getindexablecontent.rb\", \"platform\": \"PHP\", \"post_auth\": false, \"rank\": 0, \"ref_name\": \"multi/http/vbulletin_getindexablecontent\", \"references\": [\"CVE-2020-12720\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Automatic\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:18.184270Z"}