In vBulletin through 5.3.x, there is an unauthenticated deserialization vulnerability that leads to arbitrary file deletion and, under certain circumstances, code execution, because of unsafe usage of PHPs unserialize() in vB_Library_Templates cacheTemplates() function, which is a publicly exposed API. This is exploited with the templateidlist parameter to ajax/api/template/cacheTemplates.
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Vbulletin | Vbulletin | 5.0.1 (including) | 5.3.3 (including) |
| Vbulletin | Vbulletin | 5.0.0-beta_11 (including) | 5.0.0-beta_11 (including) |
| Vbulletin | Vbulletin | 5.0.0-beta_28 (including) | 5.0.0-beta_28 (including) |