Anyone Can Now Attack Unpatched vBulletin Forums Thanks to Public Exploit Code

Key points

• Public exploit code for a critical flaw in vBulletin forum software was released on July 27.
• The attack needs no login, no admin rights, and no clicks from anyone else on the site.
• SSD Secure Disclosure names vBulletin 6.2.1 and earlier, plus 6.1.6 and earlier, as vulnerable.
• The flaw lets an attacker reach PHP's eval() function, which runs whatever code they choose.
• Forum owners who have not patched should assume attempts will start hitting their servers within days.

A nasty piece of code went public on July 27, and it turns any unpatched vBulletin forum into an open door.

vBulletin is the software behind thousands of online discussion forums, from hobby communities to big brand support boards. The newly published exploit lets a complete stranger, with no account and no interaction from a moderator, take control of the server the forum runs on.

That is about as bad as web bugs get.

What does the exploit actually do?

It sends a single web request that ends up inside PHP's eval() function. In plain English: the attacker's text is treated as instructions and run by the server. From there they can read files, plant a backdoor, or pivot into whatever else the machine touches.

PHP is the programming language vBulletin is written in. The eval() function is a well-known foot-gun: it executes any string handed to it. Feeding attacker input into eval() is the forum-software equivalent of leaving the master key under the mat.

If you have covered web security for more than a week, this shape will feel familiar. It is remote code execution via server-side code injection, the same family as the classic PHP eval() bugs security researchers have been finding since the mid-2000s. Nothing about it is exotic. That is what makes it dangerous.

Which versions are affected?

vBulletin 6.2.1 and earlier, and 6.1.6 and earlier, are listed as vulnerable by SSD Secure Disclosure, the group that published the writeup. The advisory does not name a lower bound, so older installs should be treated as at risk too.

The flaw was already patched by vBulletin before the exploit went public, according to reporting by The Hacker News. So the fix exists. The question is whether admins have applied it.

Historically, many do not. vBulletin has a long tail of small forum owners running old versions on cheap hosting, and past vBulletin bugs have been mass-exploited within days of details dropping.

Should ordinary forum users worry?

Yes, a little. If you have an account on a vBulletin forum, assume that in a worst-case scenario an attacker could read the site's user database. That typically means usernames, email addresses, and password hashes, which are scrambled versions of passwords that can sometimes be cracked offline.

Two sensible steps:

• If you reused the password from a forum anywhere else, change it on those other sites now.
• Turn on two-factor authentication, an extra login code from your phone, on any account tied to that email address.

You do not need to panic. Most forums will patch. Some will not, and their user data may end up dumped on a criminal marketplace in the coming weeks. Treat any password you have ever typed into a vBulletin forum as potentially exposed.

What forum operators should do today

Update to the fixed vBulletin release. Check web server logs for odd POST requests hitting AJAX endpoints. Rotate any secrets the forum server holds, including database passwords and API keys, because a successful attacker could already have grabbed them.

If you cannot patch immediately, take the forum offline. An unpatched vBulletin on the public internet right now is a liability, not an asset.