Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: Organizations running self-hosted vBulletin forums
Incident: Public disclosure and PoC release for an unauthenticated remote code execution vulnerability in vBulletin.
Impact: Complete server compromise via unauthorized remote code execution.
Attacker: Unidentified threat actors
Analysis: The vulnerability resides in the runMaths() method, where insufficient filtering allows attackers to use a restricted-character technique to reach the PHP eval() function. By targeting the ajax/render/pagenav route, an attacker can achieve full remote code execution without any credentials. Although the initial PoC contains a minor typo, it is trivial to correct, making the exploit highly accessible.
Recommendations: Update vBulletin to version 6.2.2 or apply the latest branch-specific security patches immediately.; Audit web server logs for suspicious requests targeting the ajax/render/pagenav endpoint.; Deploy Web Application Firewall (WAF) rules to detect and block obfuscated PHP payloads in URI parameters.
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source