CVE-2005-0511
vBulletin <= 3.0.6 - Remote Code Execution via Template Parameter
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2005-0511.
PoCs published by Metasploit, pokley, including Metasploit module exploits/unix/webapp/php_vbulletin_template.
AI-analyzed exploit summary This Metasploit module exploits a PHP code execution vulnerability in vBulletin (CVE-2005-0511) by injecting arbitrary commands via the 'template' parameter in misc.php when the 'Add Template Name in HTML Comments' option is enabled.
Description
misc.php for vBulletin 3.0.6 and earlier, when "Add Template Name in HTML Comments" is enabled, allows remote attackers to execute arbitrary PHP code via nested variables in the template parameter.
Exploits (3)
This Metasploit module exploits a PHP code execution vulnerability in vBulletin (CVE-2005-0511) by injecting arbitrary commands via the 'template' parameter in misc.php when the 'Add Template Name in HTML Comments' option is enabled.
This exploit demonstrates a remote code execution (RCE) vulnerability in vBulletin 3.0.1 via template injection in the 'misc.php' script. The PoC uses PHP's string interpolation to execute arbitrary commands (e.g., 'id' or 'phpinfo()') by manipulating the 'template' parameter.
This Metasploit module exploits a PHP code execution vulnerability in vBulletin's misc.php when the 'Add Template Name in HTML Comments' option is enabled. It injects arbitrary commands via the 'template' parameter, leveraging PHP's variable interpolation to execute payloads.