CVE-2014-5102

Name of the Vulnerable Software and Affected Versions vBulletin versions 5.0.4 through 5.1.3 Alpha 5

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the criteria[startswith] parameter to the "ajax/render/memberlist items" endpoint.

Recommendations For versions 5.0.4 through 5.1.3 Alpha 5, avoid using the criteria[startswith] parameter in the "ajax/render/memberlist items" endpoint until the issue is resolved.