XenForo Template Method Call Restriction Bypass Vulnerability

A vulnerability exists in XenForo versions prior to 2.3.7, where the framework does not adequately restrict methods that can be called within templates. This flaw arises from the use of a lenient prefix matching system, allowing potentially unauthorized method calls through callbacks and variable method invocations in templates.

Impact

Exploitation of this vulnerability could lead to unauthorized method invocations, allowing attackers to execute arbitrary code or manipulate the application in unintended ways.

Remediation

Users are advised to upgrade to XenForo version 2.3.7 or apply the available patch. Instructions for upgrading and applying the patch can be found in the XenForo 2.3.7 release announcement.