vBulletin

A newly discovered vulnerability in vBulletin, a popular forum platform, has exposed thousands of online communities to the risk of unauthenticated remote code execution (RCE). The flaw allows attackers to invoke protected internal methods, enabling full system compromise without authentication. The vulnerability is present in vBulletin versions 5.x and 6.x running on PHP 8.1 or later. The issue arises from vBulletin’s reliance on PHP’s Reflection API for its custom MVC framework and API system, which allows the invocation of protected and private methods without requiring setAccessible(true). This has been confirmed in versions 5.1.0, 5.7.5, 6.0.1, and 6.0.3 running on PHP 8.1+. The vulnerability is believed to be patched in version 6.0.4.

Source: https://cybersecuritynews.com/vbulletin-forum-rce-vulnerability/

TPRM report: https://scoringcyber.rankiteo.com/company/vbulletin-solutions-inc.

"id": "vbu631052625",
"linkid": "vbulletin-solutions-inc.",
"type": "Vulnerability",
"date": "5/2025",
"severity": "25",
"impact": "",
"explanation": "Attack without any consequences: Attack in which data is not compromised. Attack in which ordinary material is compromised, but no information had been stolen."

{'affected_entities': [{'industry': 'Forum Platform',
                        'name': 'vBulletin',
                        'type': 'Software'}],
 'attack_vector': 'Exploitation of Reflection API and dynamic routing in '
                  'vBulletin',
 'description': 'A vulnerability in vBulletin versions 5.x and 6.x running on '
                'PHP 8.1 or later allows attackers to invoke protected '
                'internal methods, leading to full system compromise without '
                'authentication.',
 'impact': {'systems_affected': ['vBulletin forums running on PHP 8.1 or '
                                 'later']},
 'initial_access_broker': {'entry_point': 'ReflectionMethod::invoke() and '
                                          'ReflectionMethod::invokeArgs() '
                                          'functions in PHP 8.1'},
 'lessons_learned': 'Developers should not rely on method visibility as a '
                    'security boundary and must enforce explicit access '
                    'control at the application level, especially when using '
                    'dynamic dispatch and reflection.',
 'post_incident_analysis': {'corrective_actions': 'Patch to version 6.0.4 and '
                                                  'enforce explicit access '
                                                  'control',
                            'root_causes': 'Reliance on PHP’s Reflection API '
                                           'without explicit access control'},
 'recommendations': 'Patch vBulletin to version 6.0.4 and review application '
                    'security practices to ensure explicit access control.',
 'response': {'remediation_measures': ['Patching to version 6.0.4']},
 'title': 'vBulletin Vulnerability Leads to Unauthenticated Remote Code '
          'Execution',
 'type': 'Remote Code Execution (RCE)',
 'vulnerability_exploited': 'vBulletin’s reliance on PHP’s Reflection API for '
                            'its custom Model-View-Controller (MVC) framework '
                            'and API system'}