CVE-2016-6195: vBulletin forumrunner SQL injection via postids parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or interaction required, documented in-the-wild exploitation, and very high EPSS make this an urgent patch.

What it is

vBulletin before 4.2.2 Patch Level 5 and 4.2.3 before Patch Level 1 contains a SQL injection flaw in forumrunner/includes/moderation.php, reachable through the postids parameter to forumrunner/request.php. The record states it was exploited in the wild in July 2016, so unpatched forums face active abuse.

Impact

A remote attacker can execute arbitrary SQL commands against the forum database, potentially reading or altering any stored data, including user credentials and private messages.

Attack surface

Reachable over the network through forumrunner/request.php with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The postids parameter is the injection point.

Exploitation

Not listed in CISA KEV, but the description states exploitation in the wild in July 2016 and EPSS is 0.68493 (99.3rd percentile), indicating high predicted activity. Reference tags include a technical description and a public GitHub tool, so exploit code is likely available.

What to do

• Upgrade to vBulletin 4.2.2 Patch Level 5 or 4.2.3 Patch Level 1 or later; apply the vendor patch referenced in the vBulletin advisory.
• If immediate patching is not possible, restrict or block access to forumrunner/request.php at the web server or WAF.
• Validate and parameterize the postids parameter in forumrunner/includes/moderation.php; do not concatenate it into SQL.
• Review database and web logs for prior exploitation attempts against forumrunner/request.php.
• Rotate forum database credentials and administrator passwords if compromise is suspected.

Detection

• Search web logs for requests to forumrunner/request.php with postids values containing SQL syntax such as quotes, UNION, or comment markers.
• Monitor database error logs for SQL syntax errors originating from forumrunner requests.
• Alert on unexpected outbound connections or new administrative accounts on the forum host.
• Use the public vbully tool signatures to test and detect vulnerable endpoints in a controlled manner.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.