CVE-2025-48828
CRITICAL EXPLOITED NUCLEIvBulletin Template Conditionals - PHP Code Execution
Title source: manualExploitation Summary
CVE-2025-48828 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 2 public exploits from researchers including ill-deed, Egidio Romano (EgiX), Valentin Lobstein, including a Metasploit module exploits/multi/http/vbulletin_replace_ad_template_rce.
A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional Python scanner/exploit for CVE-2025-48828, an unauthenticated RCE vulnerability in vBulletin via the `replaceAdTemplate` endpoint. The script automates template injection and command execution, confirming vulnerability by executing the `id` command.
Description
Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By crafting template code in an alternative PHP function invocation syntax, such as the "var_dump"("test") syntax, attackers can bypass security checks and execute arbitrary PHP code, as exploited in the wild in May 2025.
Exploits (2)
This repository contains a functional Python scanner/exploit for CVE-2025-48828, an unauthenticated RCE vulnerability in vBulletin via the `replaceAdTemplate` endpoint. The script automates template injection and command execution, confirming vulnerability by executing the `id` command.
This Metasploit module exploits a design flaw in vBulletin's AJAX API handler and template rendering system, allowing unauthenticated RCE via template injection and PHP code execution. It targets versions 5.0.0 through 6.0.3 by leveraging PHP's Reflection API and PHP 8.1+ changes.
Nuclei Templates (1)
http.component:"vBulletin"
app="vBulletin"
References (3)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H