Unauthenticated protected API method invocation in vBulletin on PHP 8.1+

This repository provides a proof-of-concept exploit for CVE-2025-48827, a critical authentication bypass vulnerability in vBulletin versions 5.0.0–5.7.5 and 6.0.0–6.0.3 running on PHP 8.1 or later. The exploit is implemented in Python (main.py) and is designed to be run from the command line, taking a file of target URLs as input. It checks each target for vBulletin indicators, then attempts to access the protected API endpoint '/ajax/api/ad/wrapAdTemplate' without authentication. If the endpoint is accessible and responds as expected, the target is considered vulnerable. The exploit demonstrates the ability to invoke protected API methods remotely, which could lead to remote code execution and full system compromise. The repository includes a README with detailed usage instructions, remediation advice, and dependency information. No hardcoded IPs or domains are present; the exploit is generic and targets user-supplied URLs.

This repository contains a Python exploit script (CVE-2025-48827.py) and a README.md. The exploit targets vBulletin installations (versions 5.0.0 - 5.7.5 and 6.0.0 - 6.0.3) running on PHP 8.1, exploiting a remote code execution (RCE) vulnerability (CVE-2025-48827). The script can scan single or multiple targets (from a file), detect vBulletin installations, check for the vulnerability, and if successful, upload a PHP webshell (shell.php) to the target. The webshell allows arbitrary command execution via HTTP GET requests. The exploit is multithreaded for efficiency and provides progress feedback. The main attack vector is network-based, targeting specific vBulletin AJAX endpoints. The repository is operational and provides a working exploit with a functional payload.

This repository contains an operational exploit for a remote code execution (RCE) vulnerability in vBulletin versions 5.0.0 through 6.0.3, specifically targeting the 'ajax/api/ad/replaceAdTemplate' endpoint. The exploit consists of a Python script (vbulletin.py) and a Nuclei YAML template (vbulletin-replacead-rce.yaml). The Python script automates the exploitation process: it injects a malicious template via a POST request to the vulnerable endpoint, then uses another endpoint ('ajax/render/ad_rce') to trigger the payload and drop a PHP web shell ('shell.php') on the target server. The script provides an interactive shell for the attacker, allowing arbitrary command execution as the web server user. The YAML file is a detection template for the same vulnerability, suitable for use with the Nuclei scanner. The exploit does not require authentication and is effective against unpatched vBulletin installations within the affected version range. The repository is well-structured, with clear separation between the exploit code and detection template.