🔴 Critical | Source: The Hacker News
A public exploit has been released for a patched remote code execution vulnerability in vBulletin forum software, allowing an unauthenticated attacker to execute arbitrary code by reaching PHP’s eval() function without any account or user interaction. Affected versions include vBulletin 6.2.1 and earlier, and 6.1.6 and earlier. The public availability of working exploit code significantly raises the risk for any unpatched installations.
Security Architect’s Take: Audit your environment immediately for any internet-facing vBulletin instances and confirm they are running a patched version; if patching cannot be done immediately, place a WAF rule blocking the known exploit request pattern and consider taking the forum offline until remediation is complete.
Original advisory: Public Exploit Released for Patched vBulletin Pre-Auth Code Execution Flaw