CVE-2025-46171: 
VBulletin vulnerability analysis and mitigation

CVE-2025-46171 is a denial-of-service (DoS) vulnerability in vBulletin 3.8.7 affecting the misc.php?do=buddylist endpoint. When an authenticated user with a sufficiently large buddy list triggers this endpoint, the application executes an unbounded JOIN query across user and session tables, consuming excessive memory and potentially crashing the forum's MySQL instance. The vulnerability was discovered on April 17, 2025, assigned a CVE on May 29, 2025, and publicly disclosed on June 27, 2025. It carries a CVSS v3.1 base score of 5.4 (Medium), though Feedly estimates its severity as High (Feedly, GitHub PoC).

The root cause is Uncontrolled Resource Consumption (CWE-400) in the buddy list processing logic within misc.php. The vulnerable SQL query performs a single, unpaginated LEFT JOIN across the userlist, user, and session tables for every entry in a user's buddy list, with no result limit or pagination applied. An attacker can first inflate their buddy list by repeatedly POSTing to /profile.php with listbits parameters for thousands of user IDs, then trigger the expensive query by accessing the buddylist endpoint. Because no special privileges beyond a standard user account are required, the attack surface is broad on any forum with open registration (GitHub PoC).

Successful exploitation can cause severe query lag or a complete crash of the MySQL database instance backing the vBulletin forum, resulting in full service unavailability for all users. On large forums with many concurrent users, the resource exhaustion can degrade overall server performance and potentially affect other services sharing the same database host. There is no direct confidentiality or integrity impact beyond service disruption (GitHub PoC, Feedly).

1. Account Creation: Register or obtain a standard user account on the target vBulletin 3.8.7 forum — no elevated privileges are required.
2. Buddy List Inflation: Repeatedly POST to /profile.php with the following payload structure, iterating over thousands of valid user IDs to add them as buddies:

POST /profile.php HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

securitytoken=TOKEN&ajax=1&do=updatelist&userlist=buddy
&listbits[buddy_original][USER_ID]=USER_ID
&listbits[buddy][USER_ID]=USER_ID
&listbits[friend][USER_ID]=USER_ID
&listbits[friend_original][USER_ID]=USER_ID

3. Trigger the DoS: Once the buddy list is sufficiently large, send an authenticated GET request to misc.php?do=buddylist. This triggers the unbounded JOIN query across userlist, user, and session tables.
4. Resource Exhaustion: The database processes the entire buddy list in a single query with no pagination, consuming excessive memory and CPU, potentially crashing the MySQL instance and taking the forum offline (GitHub PoC).

• Network: Repeated POST requests to /profile.php with do=updatelist and large numbers of listbits parameters from a single IP or user account; repeated GET requests to misc.php?do=buddylist from the same account.
• Logs: Web server access logs showing high-frequency requests to /profile.php?do=updatelist and /misc.php?do=buddylist; MySQL slow query logs showing extremely long-running JOIN queries against userlist, user, and session tables.
• Database: A single user account with an abnormally large number of entries in the userlist table with type='buddy'; MySQL process list showing long-running or hung queries involving userlist LEFT JOINs.
• System: Sudden spikes in MySQL memory or CPU usage coinciding with requests to the buddylist endpoint; forum unavailability or database connection errors (GitHub PoC).

No official vendor patch has been confirmed for vBulletin 3.8.7 at the time of disclosure. Recommended mitigations include: applying pagination or a hard limit on the number of buddy entries retrieved per query in the misc.php buddylist handler; implementing rate limiting and server-side validation on buddy list modification requests to /profile.php; enforcing a maximum buddy list size per user account at the application or database level; and temporarily disabling the buddy list feature if exploitation risk is high. Administrators should also monitor MySQL slow query logs and consider upgrading to a supported vBulletin version if available (GitHub PoC, Feedly).

The vulnerability received limited but notable attention following public disclosure, with mentions on infosec community platforms such as Mastodon (infosec.exchange) and aggregation by security databases including VulDB, Vulners, Tenable, and INCIBE-CERT. The GitHub repository for the PoC has garnered 4 stars and was archived by the author shortly after disclosure. No major vendor statements or significant media coverage have been identified beyond standard CVE aggregation (Feedly).