vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization. This occurs because verify_serialized checks that a value is serialized by calling unserialize and then checking for errors. The fixed versions are 5.6.7 PL1, 5.6.8 PL1, and 5.6.9 PL1.
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Vbulletin | Vbulletin | 5.6.7 (including) | 5.6.7 (including) |
| Vbulletin | Vbulletin | 5.6.8 (including) | 5.6.8 (including) |
| Vbulletin | Vbulletin | 5.6.9 (including) | 5.6.9 (including) |