PT-2023-2195 · Vbulletin · Vbulletin

Published 2023-01-31 · Updated 2025-03-26 · CVE-2023-25135

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions vBulletin versions prior to 5.6.9 PL1

Description The issue is related to the restoration of untrusted data in memory, allowing a remote attacker to execute arbitrary code via a specially crafted HTTP request. This occurs due to the verify serialized function checking if a value is serialized by calling unserialize and then checking for errors. Over 10,000 targets related to this issue were identified.

Recommendations For versions prior to 5.6.9 PL1, update to version 5.6.9 PL1 or later to resolve the issue. As a temporary workaround, consider restricting access to the verify serialized function until a patch is available. Avoid using the unserialize function in the affected API endpoint until the issue is resolved.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2023-01940

CVE-2023-25135

Affected Products

Vbulletin

References · 13

• 🔥 https://ambionics.io/blog/vbulletin-unserializable-but-unreachable · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-25135 · Security Note
• https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4473890-vbulletin-5-6-9-security-patch · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-25135 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01940 · Security Note
• https://habr.com/ru/company/tomhunter/blog/721008 · Note
• https://t.me/cibsecurity/57440 · Telegram Post
• https://t.me/proxy_bar/1362 · Telegram Post
• https://twitter.com/BMC_001/status/1772897696489099586 · Twitter Post
• https://t.me/netlas/58 · Telegram Post
• https://t.me/cybersecuritytechnologies/8127 · Telegram Post
• https://t.me/pentestingnews/32826 · Telegram Post
• https://t.me/cvenotify/116334 · Telegram Post