CVE-2023-41362

2023-08-2916:15:09

Google

osv.dev

mybb

code injection

admin cp

validation

type juggling

pcre

php

cve-2023-41362

security error

7.5 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

35.8%

JSON

MyBB before 1.8.36 allows Code Injection by users with certain high privileges. Templates in Admin CP intentionally use eval, and there was some validation of the input to eval, but type juggling interfered with this when using PCRE within PHP.

CPENameOperatorVersion
mybbeqmybb_1814
mybbeqmybb_1825
mybbeqmybb_1833
mybbeqmybb_1821pl1
mybbeqmybb_1819
mybbeqmybb_1833_build
mybbeqmybb_1808
mybbeqmybb_1801
mybbeqmybb_1827
mybbeqmybb_1829

Name	Operator	Version
mybb	eq	mybb_1814
mybb	eq	mybb_1825
mybb	eq	mybb_1833
mybb	eq	mybb_1821pl1
mybb	eq	mybb_1819
mybb	eq	mybb_1833_build
mybb	eq	mybb_1808
mybb	eq	mybb_1801
mybb	eq	mybb_1827
mybb	eq	mybb_1829