CVE-2017-17672

Critical

Published: 14/12/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

In vBulletin versions up to 5.3.x, there is an unauthenticated deserialization vulnerability that can lead to arbitrary file deletion and, under certain circumstances, code execution. This issue arises from the unsafe usage of PHP's unserialize() function in the cacheTemplates() method of the vB_Library_Template class, which is publicly exposed.

Risk Assessment

This vulnerability poses a serious risk to organizations, allowing attackers to delete files and potentially execute malicious code on the server. This can lead to data loss and compromise the integrity of the system.

Recommendation

It is recommended to update vBulletin to the latest version to mitigate this vulnerability. Additionally, consider restricting access to public APIs and monitoring logs for potential attack attempts.

Original NVD description (English source)

In vBulletin through 5.3.x, there is an unauthenticated deserialization vulnerability that leads to arbitrary file deletion and, under certain circumstances, code execution, because of unsafe usage of PHP's unserialize() in vB_Library_Template's cacheTemplates() function, which is a publicly exposed API. This is exploited with the templateidlist parameter to ajax/api/template/cacheTemplates.