Anyone Can Now Attack Unpatched vBulletin Forums Thanks to Public Exploit Code
Working exploit code for a critical vBulletin flaw is out in the open, and it lets a stranger run commands on the server without logging in.
Key points
- Public exploit code for a critical flaw in vBulletin forum software was released on July 27.
- The attack needs no login, no admin rights, and no clicks from anyone on the site.
- SSD Secure Disclosure names vBulletin 6.2.1 and earlier, plus 6.1.6 and earlier, as vulnerable.
- The flaw lets an attacker reach PHP's eval() function, which runs whatever code they choose.
- Forum owners who haven't patched should expect attempts to start hitting their servers within days.
A nasty piece of code went public on July 27, and it turns any unpatched vBulletin forum into an open door.
VBulletin is the software behind thousands of online discussion forums, from hobby communities to brand support boards. The newly published exploit lets a complete stranger with no account take control of the server the forum runs on. No moderator interaction required.
That's about as bad as web bugs get.
What does the exploit actually do?
It sends a single web request that ends up inside PHP's eval() function. The attacker's text is treated as instructions and run by the server. From there they can read files, plant a backdoor, or do whatever else the machine permits.
PHP is the programming language vBulletin is written in. The eval() function executes any string handed to it, which makes feeding attacker input into it the forum-software equivalent of leaving the master key under the mat.
If you've covered web security for more than a week, this shape will feel familiar: remote code execution via server-side code injection, the same family of bug researchers have been finding since the mid-2000s. Nothing exotic. That's what makes it dangerous. It's the kind of attack our 20 July piece on the no-login WordPress flaws could have been filed alongside without changing a word of the lede.
Which versions are affected?
VBulletin 6.2.1 and earlier, and 6.1.6 and earlier, are listed as vulnerable by SSD Secure Disclosure, the group that published the writeup. No lower bound is given, so treat older installs as at risk too.
| Detail | Value |
|---|---|
| Software | vBulletin |
| Vulnerable versions | 6.2.1 and earlier, 6.1.6 and earlier |
| Authentication needed | None |
| User interaction needed | None |
| Public exploit released | 27 July |
VBulletin had already patched the flaw before the exploit went public, according to The Hacker News. The fix exists. Whether admins have applied it is a different matter.
VBulletin has a long tail of small forum owners running old versions on cheap hosting, and past bugs in the software have been mass-exploited within days of details dropping.
Should ordinary forum users worry?
Yes, a little. A worst-case attacker could read the site's user database: email addresses and password hashes (scrambled passwords that can sometimes be cracked offline).
Two sensible steps:
- If you reused a forum password anywhere else, change it on those other sites now.
- Turn on two-factor authentication, an extra login code from your phone, on any account tied to that email address.
Most forums will patch. Some won't, and their user data may end up on a criminal marketplace in the coming weeks. Treat any password you've ever typed into a vBulletin forum as potentially exposed.
What forum operators should do today
Update to the fixed vBulletin release. Check web server logs for unusual POST requests hitting AJAX endpoints. Rotate any secrets the forum server holds: database passwords and API keys alike, because a successful attacker could already have them.
If you can't patch immediately, take the forum offline. An unpatched vBulletin on the public internet right now is a liability, not an asset.
