This Metasploit module exploits vBulletin versions 5.x through 5.5.4 leveraging a remote command execution vulnerability via the widgetConfig[code] parameter in an ajax/render/widget_php routestring POST request.
326f81b545fe8313bbeed2d318b0e0e5050341b5d04a71833263a320f03d34af