Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By crafting template code in an alternative PHP function invocation syntax, such as the "var_dump"("test") syntax, attackers can bypass security checks and execute arbitrary PHP code, as exploited in the wild in May 2025.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact total

Affected Vendors & Products

Vendors Products
Vbulletin
  • Vbulletin

Configuration 1 [-]

cpe:2.3:a:vbulletin:vbulletin:6.0.3:*:*:*:*:*:*:*

No data.

References
Link Providers
https://blog.kevintel.com/vbulletin-replaceadtemplate-kev/ cve-icon cve-icon
https://karmainsecurity.com/dont-call-that-protected-method-vbulletin-rce cve-icon cve-icon
https://kevintel.com/CVE-2025-48828 cve-icon cve-icon
History

Wed, 25 Jun 2025 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Vbulletin
Vbulletin vbulletin
CPEs cpe:2.3:a:vbulletin:vbulletin:6.0.3:*:*:*:*:*:*:*
Vendors & Products Vbulletin
Vbulletin vbulletin

Tue, 27 May 2025 18:15:00 +0000

Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 27 May 2025 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 27 May 2025 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 27 May 2025 13:00:00 +0000

Type Values Removed Values Added
Description Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By crafting template code in an alternative PHP function invocation syntax, such as the "var_dump"("test") syntax, attackers can bypass security checks and execute arbitrary PHP code. Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By crafting template code in an alternative PHP function invocation syntax, such as the "var_dump"("test") syntax, attackers can bypass security checks and execute arbitrary PHP code, as exploited in the wild in May 2025.
References

Tue, 27 May 2025 04:15:00 +0000

Type Values Removed Values Added
Description Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By crafting template code in an alternative PHP function invocation syntax, such as the "var_dump"("test") syntax, attackers can bypass security checks and execute arbitrary PHP code.
Weaknesses CWE-424
References
Metrics cvssV3_1

{'score': 9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H'}
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2025-05-27T00:00:00.000Z

Updated: 2025-05-27T18:04:16.774Z

Reserved: 2025-05-27T00:00:00.000Z

Link: CVE-2025-48828

cve-icon Vulnrichment

Updated: 2025-05-27T13:59:25.699Z

cve-icon NVD

Status : Analyzed

Published: 2025-05-27T04:15:45.033

Modified: 2025-06-25T16:32:38.947

Link: CVE-2025-48828

cve-icon Redhat

No data.