EIP-2026-112987

PRE-CVE

vBulletin 3.0.6 - 'template' Command Execution (Metasploit)

Title source: legacy

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-112987. PoCs published by str0ke.

AI-analyzed exploit summary This is a Metasploit module exploiting a command execution vulnerability in vBulletin <= 3.0.6 by injecting a payload via the 'template' parameter in the misc.php script. The exploit encodes the payload as chr() function calls and executes it via passthru().

Description

vBulletin 3.0.6 - 'template' Command Execution (Metasploit)

Exploits (1)

exploitdb WORKING POC VERIFIED

by str0ke · webappsphp

https://www.exploit-db.com/exploits/1133

View Code ZIP pw:eip

This is a Metasploit module exploiting a command execution vulnerability in vBulletin <= 3.0.6 by injecting a payload via the 'template' parameter in the misc.php script. The exploit encodes the payload as chr() function calls and executes it via passthru().

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: vBulletin <= 3.0.6

No auth needed

Prerequisites: vBulletin <= 3.0.6 with 'Add Template Name in HTML Comments' enabled · Access to the misc.php script

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter

devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve

Tracked Since Feb 18, 2026