Skip to content
Fencer Intel
high 7.5

CVE-2015-7808 in the critical feed json

The vB_Api_Hook::decodeArguments method in vBulletin 5 Connect 5.1.2 through 5.1.9 allows remote attackers to conduct PHP object injection…

published 2015-11-24 10 y ago modified 2026-06-17 4 mo ago also EUVD-2015-7707

cvss
7.5
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
80.6%
EPSS 80.6% chance of exploitation in 30 days, percentile 99.6%
public exploits
4
Metasploit, Exploit-DB

Summary

The vB_Api_Hook::decodeArguments method in vBulletin 5 Connect 5.1.2 through 5.1.9 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object in the arguments parameter to ajax/api/hook/decodeArguments.

Timeline

  1. First public exploit (Metasploit exploit/multi/http/vbulletin_unserialize)
  2. Published

Exploit prediction

80.64% chance of exploitation in the next 30 days, higher than 99.6% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • Metasploit exploit/multi/http/vbulletin_unserialize vBulletin 5.1.2 Unserialize Code Execution metasploit exploit, excellent rank, 2015-11-04
  • EDB-48761 vBulletin 5.1.2 < 5.1.9 - Unserialize Code Execution (Metasploit) webapps, 2017-07-24
  • EDB-38790 vBulletin 5.x - Remote Code Execution webapps, 2015-11-23
  • EDB-38629 vBulletin 5.1.x - Remote Code Execution webapps, 2015-11-05
  • pastie.org http://pastie.org/pastes/10527766/text?key=wq1hgkcj4afb9ipqzllsq referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/134331/vBulletin-5.1.2-Unserialize-Code-Execution.html referenced PoC, tagged "exploit" by a source, unverified
  • blog.sucuri.net https://blog.sucuri.net/2015/11/vbulletin-exploits-in-the-wild.html referenced PoC, tagged "exploit" by a source, unverified
  • blog.checkpoint.com http://blog.checkpoint.com/2015/11/05/check-point-discovers-critical-vbulletin-0-day/ referenced PoC, tagged "exploit" by a source, unverified
  • rapid7.com http://www.rapid7.com/db/modules/exploit/multi/http/vbulletin_unserialize referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.