vendor:
MyBB
by:
BlackDream
7.5
CVSS
HIGH
Remote Code Execution
CWE
Product Name: MyBB
Affected Version From: <= 1.6.11
Affected Version To:
Patch Exists: YES
Related CWE:
CPE:
Platforms Tested: Linux
2013
MyBB <= 1.6.11 Remote Code Execution Using Admin Privileges
In older versions of MyBB, it was possible to execute PHP code by injecting the code into a template file. This bug has been fixed in the latest version, but there is a little bug in the language editor section. By exploiting this bug, an attacker with admin privileges can write PHP code in the language file and execute it. The exploit takes advantage of the fact that MyBB treats the language variable as an integer, allowing the execution of PHP functions.
Mitigation:
Update to the latest version of MyBB (greater than 1.6.11) to fix the bug. Additionally, ensure that only trusted administrators have access to the language editor section.