CVE-2005-0511

misc.php for vBulletin 3.0.6 and earlier, when "Add Template Name in HTML Comments" is enabled, allows remote attackers to execute arbitrary PHP code via nested variables in the template parameter.

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

35.82% chance of exploitation in the next 30 days, 98th percentile

Published

2005-02-23

Updated

2024-08-07

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/php_vbulletin_templa…

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/16896
• https://www.exploit-db.com/exploits/832

References

• CVE Record
• NVD entry

Related

• CVE-2005-0506
• CVE-2005-0513
• CVE-2005-0501
• CVE-2005-0517
• CVE-2005-0494
• CVE-2005-0518