In vBulletin through 5.3.x, there is an unauthenticated deserialization vulnerability that leads to arbitrary file deletion and, under certain circumstances, code execution, because of unsafe usage of PHP's unserialize() in vB_Library_Template's cacheTemplates() function, which is a publicly exposed API. This is exploited with the templateidlist parameter to ajax/api/template/cacheTemplates.

References

• https://nvd.nist.gov/vuln/detail/CVE-2017-17672
• https://blogs.securiteam.com/index.php/archives/3573
• https://www.exploit-db.com/exploits/43362/