A critical Remote Code Execution vulnerability in vBulletin 6.0.1 allows unauthenticated attackers to execute arbitrary PHP code through the replaceAdTemplate method. The flaw affects vBulletin versions 5.1.0, 5.7.5, 6.0.1, and 6.0.3 running on PHP 8.1+. Attackers can exploit this by sending malicious POST requests to /ajax/api/ad/replaceAdTemplate with crafted template parameters, potentially leading to full server compromise. The vulnerability stems from improper exposure of protected methods through the front-end API.
Table of contents
① Identify a Target (For Research Purposes Only)② Monitor HTTP Requests Using Burp Suite③ Look for API Request Endpoints④ Modify the Request⑤ Observe the Response⑥ Escalate to Command Execution⑦ Validate Command Execution⑧ Security RecommendationSort: