CVE-2025-48827
CRITICAL EXPLOITED NUCLEIvBulletin 5.0.0-5.7.5 and 6.0.0-6.0.3 - Unauthenticated API Controller Method Invocation
Title source: llmExploitation Summary
CVE-2025-48827 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 4 public exploits from researchers including 0xgh057r3c0n, SystemVll, wiseep, including a Metasploit module exploits/multi/http/vbulletin_replace_ad_template_rce.
A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2025-48827, targeting vBulletin's ajax/api/ad/replaceAdTemplate endpoint. The exploit leverages improper PHP Reflection API usage to inject a malicious template, enabling unauthenticated RCE via crafted <vb:if> conditionals and subsequent command execution through ajax/render/ad_<location>.
Description
vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern, as exploited in the wild in May 2025.
Exploits (4)
This repository contains a functional exploit for CVE-2025-48827, targeting vBulletin's ajax/api/ad/replaceAdTemplate endpoint. The exploit leverages improper PHP Reflection API usage to inject a malicious template, enabling unauthenticated RCE via crafted <vb:if> conditionals and subsequent command execution through ajax/render/ad_<location>.
This repository contains a functional Python-based exploit for CVE-2025-48827, an authentication bypass vulnerability in vBulletin 5.0.0–5.7.5 and 6.0.0–6.0.3 running on PHP 8.1+. The exploit sends a crafted request to the `/ajax/api/ad/wrapAdTemplate` endpoint to confirm vulnerability.
This repository contains a functional exploit for CVE-2025-48827, targeting vBulletin versions 5.0.0-5.7.5 and 6.0.0-6.0.3 with PHP 8.1. The exploit automates detection, RCE testing, and shell upload via a crafted template injection in the 'ajax/api/ad/replaceAdTemplate' endpoint.
This Metasploit module exploits a design flaw in vBulletin's AJAX API handler and template rendering system, allowing unauthenticated attackers to execute arbitrary commands via template injection and reflection API misuse. It targets versions 5.0.0 through 6.0.3, leveraging PHP 8.1+ behaviors to achieve RCE.
Nuclei Templates (1)
http.component:"vBulletin"
app="vBulletin"
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H