CVE-2023-25135

nvd nist nuclei

Published: Feb 3, 2023Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization. This occurs because verify_serialized checks that a value is serialized by calling unserialize and then checking for errors. The fixed versions are 5.6.7 PL1, 5.6.8 PL1, and 5.6.9 PL1.

Affected (3)

Products: Vbulletin: Vbulletin

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Vbulletin Vbulletin	Version 5.6.7
Vbulletin Vbulletin	Version 5.6.8
Vbulletin Vbulletin	Version 5.6.9

Related CWEs

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (4)

https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4473890-vbulletin-5-6-9-security-patch

Source: cve@mitre.org

Release NotesVendor Advisory

https://www.ambionics.io/blog/vbulletin-unserializable-but-unreachable

Source: cve@mitre.org

ExploitTechnical DescriptionThird Party Advisory

https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4473890-vbulletin-5-6-9-security-patch

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

https://www.ambionics.io/blog/vbulletin-unserializable-but-unreachable

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitTechnical DescriptionThird Party Advisory

Timeline

No history available yet.