为什么值得关注

它同时包含了完整的渗透工具集和安全的验证脚本，覆盖 18 个攻击端点，使用 PHPFuck 编码绕过 WAF，并提供反向外壳、持久化、批量扫描等丰富的后渗透功能。

适合谁使用

获得授权的渗透测试人员和红队成员
蓝队和安全审计人员
负责版本修补验证的 vBulletin 管理员
进行负责任披露的漏洞赏金猎人

典型使用场景

对 vBulletin 安装进行无侵入的漏洞评估
获得授权的渗透测试，包含完整的利用和后渗透操作
批量扫描多个目标以识别存在漏洞的实例
事件响应时验证系统是否已被该 CVE 入侵

项目优势

将安全检测脚本 (safecheck.py) 与完整利用脚本 (exploit.py) 清晰分离
针对 18 个不同的漏洞端点进行测试，提高检测可靠性
通过 PHPFuck 编码绕过 WAF，即使在受限环境中也能传递载荷
提供广泛的后渗透模块（反向外壳、持久化、数据库导出、端口转发等）

使用前须知

仅支持 vBulletin 5.0.0–5.7.5 和 6.0.0–6.2.1 版本，已修补的版本不可利用
需要明确的书面授权才能使用，滥用可能导致法律处罚
利用依赖于特定的 eval() 注入，可能被超出 PHPFuck 覆盖范围的自定义 WAF 规则阻止

README 快速开始

CVE-2026-61511 – vBulletin Pre‑Auth RCE Exploit & Verifier

⚠️ ETHICAL USE ONLY – AUTHORIZED SECURITY TESTING
This repository provides tools for authorized security professionals, blue teams, and penetration testers only.
Unauthorized access to computer systems is illegal under CFAA (US), Computer Misuse Act (UK), TCK 243/244 (Turkey), and similar laws worldwide.

📖 Vulnerability Overview

CVE‑2026‑61511 is a PHP eval() injection flaw in vBulletin's AJAX template rendering engine.
Affected versions: 5.0.0 – 5.7.5 and 6.0.0 – 6.2.1.

How it works

Multiple attack endpoints – the bug exists in several AJAX handlers:
- /ajax/render/pagenav
- /ajax/api/ad/replaceAdTemplate
- /ajax/render/widget_php
- /ajax/render/widget_tabbedcontainer_tab_panel
- Various /ajax/api/content_* /getIndexableContent endpoints
PHPFuck encoding – the payload is transformed into a sequence of PHP operators and numbers that bypasses WAF filters and allows arbitrary PHP code execution.
No authentication required – an attacker can send a crafted POST request to any vulnerable endpoint and execute system commands with the privileges of the web server.
Impact – full server compromise, data theft, backdoors, lateral movement, and persistence. Upgrade the version!

Patch

vBulletin 6.2.2 and Patch Level 1 for older versions fix this issue.
Always upgrade to the latest version.

🧰 Tools

Tool	Purpose	Intended User
`exploit.py`	Full toolkit with reverse shell, persistence, file operations, database dump, firewall management, log management, port forwarding, SSH key deployment, network scanning, and mass scanning (multi‑threaded).	Red teams / authorized pentesters
`safecheck.py`	Non‑intrusive verifier that checks vulnerability without executing any malicious payload. Detects version, tests all endpoints, and generates a detailed report.	Blue teams / security auditors

📊 Feature Comparison

Feature	`exploit.py`	`safecheck.py`
Vulnerability detection	✅	✅
Version detectio

项目描述

CVE-2026-61511 – vBulletin Pre-Auth RCE (CVSS 9.8). Vuln 5.x/6.x (unpatched). Multi-exploit via Endpoint Pool, AJAX, PHPFuck WAF bypass. Full toolkit: reverse shell, proxy, persistence, webshell, database operations, firewall control, log management, mass scanning. 2 versions: multi-exploit & safe-check. Python 3.8+ Use Ethically, Stay Legal. 🔒

CVE-2026-61511-PoC-Exploit