A successful exploit may allow an unauthenticated attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Upgrade to Tapatalk vBulletin 4.x plugin series 5.2.2 or higher.

Tapatalk for vBulletin 4.x does not properly sanitize some xmlrpc calls for unsubscribe_topic, unsubscribe_forum allowing unauthenticated users to inject arbitrary SQL commands.

Tapatalk for vBulletin 4.x plugin series 5.2.1 and below.

Check the version of Tapatalk vBulletin 4.x plugin.

• http://www.securityfocus.com/bid/70418/
• https://github.com/tintinweb/pub/tree/master/pocs/cve-2014-2023

---

Updated on 2015-03-25