A critical eval injection vulnerability in vBulletin allows unauthenticated remote attackers to execute arbitrary code, posing a severe risk of full system compromise.

This is an eval injection vulnerability occurring in the vB5_Template_Runtime::runMaths() method. Unauthenticated attackers can bypass weak regex filters using specific character encoding to inject and execute arbitrary PHP code via the ajax/render route.

The CVSS score of 9.8 reflects the high potential for total system compromise, including unauthorized data access, modification, and complete loss of server control. Successful exploitation allows remote attackers to execute commands with the privileges of the web server, leading to severe reputational damage and operational downtime.

Immediate Action: Upgrade to vBulletin version 6.2.2 or later, which contains the necessary security fixes for this flaw.

Proactive Monitoring: Review web server and application logs for suspicious requests targeting the ajax/render template path or containing encoded PHP syntax.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to block malicious input patterns, specifically targeting template parameters that utilize mathematical functions.

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub.

Given the critical severity and the availability of public proof-of-concept code, immediate action is required. Administrators should prioritize upgrading to the patched version of vBulletin to eliminate the injection vector and secure the application environment.