CVE-2025-48828

Published May 27, 2025

Last updated 10 days ago

vBulletin

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-48828 is a vulnerability affecting vBulletin, a forum software package. It allows attackers to execute arbitrary PHP code by exploiting Template Conditionals in the template engine. This is achieved by crafting malicious template code using alternative PHP function invocation syntax, such as 'var_dump'('test'), which bypasses existing security checks. The vulnerability stems from the ability to invoke protected API controller methods due to changes in PHP 8.1's ReflectionMethod behavior, combined with the ability to bypass template engine security checks. Versions 5.x and 6.x up to 6.0.3 are affected, and a fix is believed to be included in vBulletin version 6.0.4 and later.

Description: Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By crafting template code in an alternative PHP function invocation syntax, such as the "var_dump"("test") syntax, attackers can bypass security checks and execute arbitrary PHP code, as exploited in the wild in May 2025.
Source: cve@mitre.org
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9
Impact score: 6
Exploitability score: 2.2
Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

cve@mitre.org: CWE-424

Hype score: Not currently trending

References