Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

vBulletin remote code execution via template comments

CVE-2005-0511 · published 21 years ago
Summary

If the "Add Template Name in HTML Comments" option is turned on in vBulletin 3.0.6 or earlier, an attacker can inject malicious PHP code through specially crafted template parameters. This can let the attacker run any code on your server, potentially stealing data or taking control. Disable that option or upgrade to a patched version of vBulletin as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
jelsoft vbulletin 2.0
2.0.1
2.0.2
2.0_beta_2
2.0_beta_3
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
17 more version ranges
cpe:2.3:a:jelsoft:vbulletin:2.0:*:*:*:*:*:*:*
Original advisory text
misc.php for vBulletin 3.0.6 and earlier, when "Add Template Name in HTML Comments" is enabled, allows remote attackers to execute arbitrary PHP code via nested variables in the template parameter.
misc.php for vBulletin 3.0.6 and earlier, when "Add Template Name in HTML Comments" is enabled, allows remote attackers to execute arbitrary PHP code via nested variables in the template parameter.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
36% chance of attack within 30 days
Timeline
Published21 Feb 2005
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CVE-2005-0511 · NVD
Track software like this
Free during beta