CVE-2019-17271

Name of the Vulnerable Software and Affected Versions vBulletin version 5.5.4

Description The issue allows SQL Injection via the "ajax/api/hook/getHookList" or "ajax/api/widget/getWidgetList" API endpoints, where a specific parameter is vulnerable.

Recommendations For version 5.5.4, consider restricting access to the "ajax/api/hook/getHookList" and "ajax/api/widget/getWidgetList" API endpoints until a patch is available. Avoid using the vulnerable parameter in these endpoints to minimize the risk of exploitation.