vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input through the pagenav[pagenumber] parameter. Attackers can exploit the insufficiently restrictive regex filter by using phpfuck-style encoding with permitted characters to inject and execute arbitrary PHP code via the unauthenticated ajax/render template route without any authentication.

Affected: vBulletin

----------------------------------------------------------------- vBulletin <= 6.2.1 (runMaths) Remote Code Execution Vulnerability -----------------------------------------------------------------

[-] Software Link:

https://www.vbulletin.com

[-] Affected Versions:

Version 5.7.5 and prior 5.x versions. Version 6.2.1 and prior 6.x versions.

[-] Vulnerability Description:

The vulnerable code is located within the /includes/vb5/template/runtime.php script. Specifically, into the vB5_Template_Runtime::runMaths() method: the $str parameter is not sufficiently sanitized before being used in an eval() call. The regex used to validate the input parameter will filter the string only allowing for digits, parentheses, math and binary operators (the XOR, particularly). As such, this can be exploited to inject and execute (semi) arbitrary PHP code through "phpfuck" techniques. The vulnerability could be exploited by e.g. administrator users, by editing a template/style in the admin panel and adding a specially crafted {vb:math} tag (which is a sort of wrapper around the vB5_Template_Runtime::runMaths() method). However, this can also be exploited by unauthenticated attackers by abusing the ajax/render/[template] route, rendering a template which uses the {vb:math} tag with an user-tainted parameter. One of the possible templates that can be abused that way is the default "pagenav" template: here, user input passed through the "pagenav[pagenumber]" parameter will be assigned to t…

vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input through the pagenav[pagenumber] parameter. Attackers can exploit the insufficiently restrictive regex filter by using phpfuck-style encoding with permitted characters to inject and execute arbitrary PHP code via the unauthenticated ajax/render template route without any authentication.