Vulnerability record · CVE-2013-6129 · published 19 October 2013
CVE-2013-6129: vBulletin install/upgrade.php lets attackers create admin accounts
VVbulletin · Vbulletin
The install/upgrade.php scripts in vBulletin 4.1 and 5 accept customerid, htmldata[password], htmldata[confirmpassword] and htmldata[email] parameters without adequate access control, allowing a remote attacker to create an administrative account. Because the flaw is reachable over the network with no authentication, any exposed installation is at risk of full compromise.
Description
The install/upgrade.php scripts in vBulletin 4.1 and 5 allow remote attackers to create administrative accounts via the customerid, htmldata[password], htmldata[confirmpassword], and htmldata[email] parameters, as exploited in the wild in October 2013.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityUnauthenticated remote creation of an administrative account is a full-compromise primitive, and the record notes in-the-wild exploitation with very high EPSS, though it is not in KEV.
What it is
The install/upgrade.php scripts in vBulletin 4.1 and 5 accept customerid, htmldata[password], htmldata[confirmpassword] and htmldata[email] parameters without adequate access control, allowing a remote attacker to create an administrative account. Because the flaw is reachable over the network with no authentication, any exposed installation is at risk of full compromise.
Impact
An attacker gains a working administrator account on the forum, leading to full control of the site, its data and its users.
Attack surface
Reached remotely over HTTP through the install/upgrade.php script; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.
Exploitation
The description states the flaw was exploited in the wild in October 2013 and references are tagged Exploit, but the CVE is not listed in CISA KEV; EPSS is 0.51887 (98.9th percentile), indicating high predicted exploitation activity.
What to do
- Apply the vBulletin fix or upgrade to a corrected release per the vendor announcement; patch first.
- Remove or block access to install/ and upgrade.php on production servers.
- Restrict administrative and installer paths to trusted IPs via web server or WAF rules.
- Audit existing administrator accounts for unauthorized additions and remove any that are not legitimate.
- Rotate credentials and review logs for suspicious account creation activity.
Detection
- Monitor web logs for POST requests to install/upgrade.php containing customerid, htmldata[password] or htmldata[email] parameters.
- Alert on creation of new administrator accounts, especially outside normal change windows.
- Review vBulletin admin and user tables for accounts with elevated privileges that lack a known owner.
- Correlate installer-path access with subsequent admin logins from the same source IP.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2013-6129 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2013-6129), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
