Public exploit reaches PHP eval in vBulletin for unauthenticated code execution

Public exploit details released on July 27 show how an unauthenticated request can reach PHP's eval function inside vBulletin and run code on an unpatched forum server. The attack needs no account, administrative access, or interaction from another user, making any internet-facing vulnerable forum a direct target. SSD Secure Disclosure lists vBulletin 6.2.1 and earlier and 6.1.6 and earlier as affected, without giving a lower version boundary. Forum software is an attractive target because it is public by design, often runs with limited maintenance, and a single compromised server can host web shells, redirect visitors, or expose community member data. Administrators should confirm their version and patch level.

Check

Confirm the vBulletin version on any forum you run, apply the vendor's patches, and inspect the server for web shells and unexpected PHP files given that a public exploit exists.

Affected

Internet-facing vBulletin forums on 6.2.1 and earlier or 6.1.6 and earlier; an unauthenticated request reaches PHP eval for remote code execution, and working exploit details are now public.

Fix

Update vBulletin to a patched release, place a web application firewall in front of the forum, restrict server file writes, and monitor for unexpected processes spawned by the web server.