CVE-2023-25135

CRITICALNuclei

vBulletin vBulletin Deserialization of Untrusted Data

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2023-25135 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization. This occurs because verify_serialized checks that a value is serialized by calling unserialize and then checking for errors. The fixed versions are 5.6.7 PL1, 5.6.8 PL1, and 5.6.9 PL1.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Dec 4, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 26, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

vBulletin

Browse vBulletin / vBulletin
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryCRITICALvBulletin <= 5.6.9 - Pre-authentication Remote Code ExecutionCVSS 9.8

vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization. This occurs because verify_serialized checks that a value is serialized by calling unserialize and then checking for errors.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the target system.

Remediation

Upgrade to the latest version to mitigate this vulnerability.

WeaknessesCWE-502
Authorsiamnoooob, rootxharsh, pdresearch
Template tagscvecve2023vbulletinrcevkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:vbulletin:vbulletin:5.6.7:-:*:*:*:*:*:*
Shodan: http.component:"vBulletin"
Shodan: http.html:"powered by vbulletin"
Shodan: http.component:"vbulletin"
Shodan: http.title:"powered by vbulletin"
Shodan: cpe:"cpe:2.3:a:vbulletin:vbulletin"
FOFA: body="powered by vbulletin"
FOFA: title="powered by vbulletin"
Google: intext:"Powered By vBulletin"
Google: intitle:"powered by vbulletin"
Google: intext:"powered by vbulletin"
https://www.ambionics.io/blog/vbulletin-unserializable-but-unreachable https://github.com/ambionics/vbulletin-exploits/blob/main/vbulletin-rce-cve-2023-25135.py https://nvd.nist.gov/vuln/detail/CVE-2023-25135 https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4473890-vbulletin-5-6-9-security-patch https://github.com/netlas-io/netlas-dorks

Source: ProjectDiscovery

References

3