Monday, May 19, 2025
HomeExploitvBulletin Forum Software RCE Zero-day Exploit Published Online By Anonymous Hacker -...

vBulletin Forum Software RCE Zero-day Exploit Published Online By Anonymous Hacker – Unpatched

Published on

SIEM as a Service

Follow Us on Google News

An anonymous hacker publicly disclosed an unpatched vBulletin forum software pre-auth RCE Zero-day Exploit.

vBulletin is one of the most popular and widely used forum software which is written in PHP, and the new version of vBulletin software release just 20 days ago.

According to the Exploit writer who has posted in the exploit code in online said “This should work on all versions from 5.0.0 till 5.5.4”

- Advertisement - Google News

It’s unclear why the researcher discloses the exploit in public instead of reporting to the vBulletin team, and if he did this, the researcher would have to make up to $10000 as a bug bounty reward since the exploitable RCE vulnerability belongs to “Critical” severity category.

GBHackers Team analyzed the code and confirmed that the vulnerability allows attackers to execute a remote command via widgetConfig[code] parameter and inject the shellcode in the forum server where the vBulletin installation package resides.

The disclosed exploit code takes advantage of the vulnerability that existing up to vBulletin 5.4 version due to improper validation in “ajax/render/widget_php” during the time of processing data through “widgetConfig[code]” HTTP POST parameter. you can have a look at the following python script published by the researcher online. 

vBulletin RCE Zero-day Exploit code

An attacker doesn’t need to have an account on the forum that used vBulletin software version 5.4 and below to exploit the vulnerability, and the attacker can send a specially crafted HTTP POST request to execute the arbitrary code in the targeted forum.

The researcher called this vulnerability as “pre-auth Remote code execution” which is categorized as a critical severity, and the successful exploit this vulnerability may result in the complete compromise of a vulnerable system remotely.

There are very few percentages (less than 1 %) of the total website on the internet used the vBulletin forum software, but there are millions of users who have registered in the forum are now affected.

There is no patch published yet, We may expect the vBulletin team fix the vulnerability and release the patch soon.

Stay tuned, we will update here once we get the patch update.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Also Read: Microsoft Emergency Patch – IE Zero-day Vulnerability Let Hackers Execute Arbitrary Code Remotely in Windows PC

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Confluence Servers Under Attack: Hackers Leverage Vulnerability for RDP Access and Remote Code Execution

Threat actors exploited a known vulnerability, CVE-2023-22527, a template injection flaw in Atlassian Confluence...

New ModiLoader Malware Campaign Targets Windows PCs, Harvesting User Credentials

AhnLab Security Intelligence Center (ASEC) has recently uncovered a malicious campaign distributing ModiLoader (also...

Health Care Data Breach Costs BreachForums Admin $700,000 Fine

Conor Brian Fitzpatrick, the 22-year-old former administrator of cybercrime forum Breachforums, will forfeit approximately...

Critical Firefox 0-Day Flaws Allow Remote Code Execution

Mozilla has urgently patched two critical 0-day vulnerabilities in its popular web browser Firefox,...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

PoC Exploit Published for macOS Sandbox Escape Vulnerability (CVE-2025-31258)

Security researchers have disclosed a new macOS sandbox escape vulnerability tracked as CVE-2025-31258, accompanied...

New Advanced Phishing Attack Exploits Discord to Target Crypto Users

Check Point Research has uncovered a sophisticated phishing campaign that leverages Discord to target...

Researcher Exploits Regex Filter Flaw ...

Target application included a username field restricted by a frontend regex filter (/^{1,20}$/), designed...