Public Exploit Released for Patched vBulletin Pre-Auth Code Execution Flaw

A public exploit has been released for a pre-authentication code execution vulnerability in vBulletin. The exploit allows an unauthenticated request to execute code on an unpatched forum server by reaching PHP's eval() function. This attack can be carried out without requiring an account, administrative access, or interaction from another user. The vulnerability is known to affect vBulletin versions 6.2.1 and earlier, as well as 6.1.6 and earlier.