CVE-2025-48827

Published May 27, 2025

Last updated 10 days ago

vBulletin

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-48827 affects vBulletin versions 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3. The vulnerability allows unauthenticated users to invoke protected API controller methods when running on PHP 8.1 or later. This can be exploited using the `/api.php?method=protectedMethod` pattern. The flaw arises from the misuse of PHP's Reflection API within vBulletin's API controller logic, particularly in PHP 8.1, which allows the invocation of protected and private methods through `ReflectionMethod::invoke()`. Attackers can exploit the flaw by directly invoking internal protected methods not intended for external access. The `vB_Api_Ad::replaceAdTemplate()` method can act as a remote code execution (RCE) vector by allowing the creation or modification of advertisement templates, where malicious code can be injected.

Description: vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern, as exploited in the wild in May 2025.
Source: cve@mitre.org
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 10
Impact score: 6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

cve@mitre.org: CWE-424

Hype score: Not currently trending

References