Collected research
Unserializable, but unreachable: Remote code execution on vBulletin
A pre-authentication unserialize sits in vBulletin's ORM, where an array field is validated by deserialising it. No in-tree gadget works because every vBulletin class blocks wakeup, so the researchers deserialise a fake class name that the autoloader converts into a file path, forcing it to include a disabled package's Composer autoloader and bringing Monolog gadget chains into scope for RCE.
Record
- Published by
- blog.lexfo.fr
- Topic
- Server
In the archive
Related sources
Tags
This page is the archive's own catalogue record. The research is the work of blog.lexfo.fr, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .