Unauthenticated Protected API Method Invocation in vBulletin on PHP 8.1+

This repository is a small standalone Python proof-of-concept for CVE-2025-48827, described as a vBulletin authentication bypass affecting versions 5.0.0–5.7.5 and 6.0.0–6.0.3 on PHP 8.1+. The repository structure is minimal: README.md documents the vulnerability and usage, main.py contains the exploit logic, pyproject.toml and uv.lock define Python dependencies, and the remaining files are environment/ignore metadata. The main exploit workflow in main.py is straightforward. It accepts a file of target base URLs, normalizes each URL, and uses requests.Session for HTTP interaction. For each target, it first performs a reconnaissance step by issuing a GET request to the site root and searching the response body for common vBulletin markers such as 'vbulletin', 'powered by vBulletin', 'vbulletin_global.js', and 'vbulletin_md5.js'. If indicators are found, it then probes the suspected vulnerable endpoint /ajax/api/ad/wrapAdTemplate with a POST request to determine whether the API path is accessible. Status codes 200, 405, or 500 are treated as signs that the endpoint exists and may be exploitable. The exploit stage sends an unauthenticated POST request with randomized form fields ('template' and 'id_name') and AJAX-like headers including Content-Type: application/x-www-form-urlencoded and X-Requested-With: XMLHttpRequest. Based on the README and visible code, the script is intended to confirm the authentication bypass by inspecting the HTTP/JSON response for expected patterns and then reporting success. The visible code does not show a follow-on arbitrary command execution payload, reverse shell, file write, or persistence mechanism. As such, this is best classified as a POC exploit/verifier rather than a weaponized RCE tool. Operationally, the script is a batch scanner/exploit helper: it loads multiple targets from a text file, iterates through them, logs status with colored console output, and prints a final count of successful exploit attempts. There is no evidence of framework integration, obfuscation, destructive behavior, or fake/malicious local actions. The primary fingerprintable target endpoint is /ajax/api/ad/wrapAdTemplate, and the exploit is clearly aimed at remote web exploitation of exposed vBulletin instances.

This repository provides a proof-of-concept exploit for CVE-2025-48827, a critical authentication bypass vulnerability in vBulletin versions 5.0.0–5.7.5 and 6.0.0–6.0.3 running on PHP 8.1 or later. The exploit is implemented in Python (main.py) and is designed to be run from the command line, taking a file of target URLs as input. It checks each target for vBulletin indicators, then attempts to access the protected API endpoint '/ajax/api/ad/wrapAdTemplate' without authentication. If the endpoint is accessible and responds as expected, the target is considered vulnerable. The exploit demonstrates the ability to invoke protected API methods remotely, which could lead to remote code execution and full system compromise. The repository includes a README with detailed usage instructions, remediation advice, and dependency information. No hardcoded IPs or domains are present; the exploit is generic and targets user-supplied URLs.

This repository contains a single Metasploit module (Ruby file) that exploits a remote code execution vulnerability in vBulletin versions 5.0.0 through 6.0.3 (CVE-2025-48827, CVE-2025-48828). The exploit leverages a design flaw in vBulletin's AJAX API and template rendering system, specifically targeting the 'ajax/api/ad/replaceAdTemplate' endpoint to inject a malicious template. The injected template uses a <vb:if> conditional to execute attacker-supplied PHP code via the system() function. The exploit is triggered by a subsequent POST request to 'ajax/render/ad_<location>', which executes the injected code. The module supports both Unix/Linux and Windows payloads, allowing for arbitrary command execution as the webserver user without authentication. The code is weaponized, as it is part of the Metasploit framework and supports customizable payloads. The repository is structured as a single Ruby file, following standard Metasploit module conventions, and is intended for use within the Metasploit exploitation framework.

This repository contains a Python exploit script (CVE-2025-48827.py) and a README.md. The exploit targets vBulletin installations (versions 5.0.0 - 5.7.5 and 6.0.0 - 6.0.3) running on PHP 8.1, exploiting a remote code execution (RCE) vulnerability (CVE-2025-48827). The script can scan single or multiple targets (from a file), detect vBulletin installations, check for the vulnerability, and if successful, upload a PHP webshell (shell.php) to the target. The webshell allows arbitrary command execution via HTTP GET requests. The exploit is multithreaded for efficiency and provides progress feedback. The main attack vector is network-based, targeting specific vBulletin AJAX endpoints. The repository is operational and provides a working exploit with a functional payload.

This repository contains an operational exploit for a remote code execution (RCE) vulnerability in vBulletin versions 5.0.0 through 6.0.3, specifically targeting the 'ajax/api/ad/replaceAdTemplate' endpoint. The exploit consists of a Python script (vbulletin.py) and a Nuclei YAML template (vbulletin-replacead-rce.yaml). The Python script automates the exploitation process: it injects a malicious template via a POST request to the vulnerable endpoint, then uses another endpoint ('ajax/render/ad_rce') to trigger the payload and drop a PHP web shell ('shell.php') on the target server. The script provides an interactive shell for the attacker, allowing arbitrary command execution as the web server user. The YAML file is a detection template for the same vulnerability, suitable for use with the Nuclei scanner. The exploit does not require authentication and is effective against unpatched vBulletin installations within the affected version range. The repository is well-structured, with clear separation between the exploit code and detection template.