CVE-2015-7808

This exploit leverages a PHP object injection vulnerability in vBulletin 5.x via the `/ajax/api/hook/decodeArguments` endpoint. It achieves remote code execution by manipulating serialized objects to execute arbitrary system commands.

This exploit leverages a PHP object injection vulnerability in vBulletin 5.1.x via the `decodeArguments` endpoint. It constructs a serialized payload that triggers the `__destruct` method of `vB_dB_Result`, leading to arbitrary method execution (e.g., `phpinfo`).

This Metasploit module exploits a PHP object injection vulnerability in vBulletin 5.1.2 to 5.1.9 via deserialization in the 'ajax/api/hook/decodeArguments' endpoint. It leverages the 'vB_dB_Result' class to execute arbitrary PHP code through the 'assert' function.

This repository contains a functional Perl exploit for CVE-2015-7808, a pre-authentication PHP object injection vulnerability in vBulletin. The exploit leverages unsafe deserialization in the `vB_dB_Result` class to execute arbitrary commands via the `assert` function.

This Metasploit module exploits a PHP object injection vulnerability in vBulletin 5.1.2 to 5.1.9 via unsafe unserialize in the 'decodeArguments' endpoint. It chains gadgets to achieve remote code execution by leveraging the 'vB_dB_Result' and 'vB_Database' classes.