CVE-2025-48827 - vBulletin Authentication Bypass Exploit

Overview

This repository contains a proof-of-concept exploit for CVE-2025-48827, a critical authentication bypass vulnerability affecting vBulletin 5.0.0–5.7.5 and 6.0.0–6.0.3 when running on PHP 8.1 or later. The vulnerability allows unauthenticated attackers to invoke protected API methods remotely, potentially leading to remote code execution and full system compromise.

• Author: pszyszkowski
• Severity: Critical
• CVE: CVE-2025-48827
• References:
  • https://karmainsecurity.com/dont-call-that-protected-method-vbulletin-rce

Impact

Successful exploitation allows unauthenticated remote attackers to execute arbitrary system commands as the web server user, resulting in full system compromise.

Requirements

• Python 3.7+
• requests library
• colored library
• pyfiglet library

Install dependencies:

pip install requests colored pyfiglet

Usage

Prepare a text file (e.g., targets.txt) with one target URL per line:

http://example.com
https://forum.example.org

Run the exploit:

python main.py targets.txt

Optional: Set a custom timeout (default is 10 seconds):

python main.py targets.txt --timeout 20

How It Works

• Checks if the target is running vBulletin by looking for common indicators.
• Sends a crafted unauthenticated request to /ajax/api/ad/wrapAdTemplate.
• Confirms exploitation by checking for specific patterns in the JSON response.
• Reports vulnerable targets and provides remediation advice.

Remediation

• Upgrade to vBulletin 6.0.4+ before upgrading to PHP 8.1.
• Apply the latest security patches.

Disclaimer

This tool is for educational and authorized security testing purposes only. Do not use against systems without explicit permission.