CVE-2022-43708

MyBB 1.8.31 has a issue 2 of 2 cross-site scripting XSS vulnerabilities in the post Attachments interface allow attackers to inject HTML by persuading the user to upload a file with specially crafted name...

PT-2022-27015 · Mybb · Mybb

Name of the Vulnerable Software and Affected Versions: MyBB version 1.8.31 Description: The issue allows remote authenticated users to modify the query string via direct user input or stored search filter settings in the Admin CP's Users module, resulting in a SQL injection vulnerability...

CVE-2022-43707

MyBB 1.8.31 has a Cross-site scripting XSS vulnerability in the visual MyCode editor SCEditor allows remote attackers to inject HTML via user input or stored data...

CVE-2022-43709

Summary of CVE-2022-43709 : MyBB 1.8.31 contains a SQL injection vulnerability in the Admin CP → Users module. The issue allows remote authenticated users to modify the query string via direct user input or stored search filter settings, enabling partial data integrity impact as described in the ...

MyBB Command Injection Vulnerability

MyBB MyBulletinBoard is a free and web-based forum software developed by MYBB team using PHP and MySQL. The software is easy to use, supports multiple languages, and is extensible.MyBB is vulnerable to a command injection vulnerability that originates from the additional parameter Mail Settings ?...

MyBB < 1.8.31 RCE Vulnerability (GHSA-hxhm-rq9f-7xj7)

MyBB is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mybb:mybb";...

CVE-2022-39265

MyBB is a free and open source forum software. The Mail Settings → Additional Parameters for PHP's mail function mailparameters setting value, in connection with the configured mail program's options and behavior, may allow access to sensitive information and Remote Code Execution RCE. The...

Double free

MyBB is a free and open source forum software. The Mail Settings ? Additional Parameters for PHP's mail function mailparameters setting value, in connection with the configured mail program's options and behavior, may allow access to sensitive information and Remote Code Execution RCE. The...

PT-2022-24855 · Mybb · Mybb

Name of the Vulnerable Software and Affected Versions: MyBB versions prior to 1.8.31 Description: The issue in MyBB allows access to sensitive information and Remote Code Execution RCE through the mail parameters setting value in the Mail Settings → Additional Parameters for PHP's mail function, ...

CVE-2022-39265

CVE-2022-39265 affects MyBB prior to 1.8.31. The vulnerability arises from the Mail Settings → Additional Parameters for PHP’s mail() function, where the mail_parameters setting, in combination with the configured mail program’s options, can expose sensitive information and enable Remote Code Exe...

CVE-2022-39265 Mail settings' command parameter injection in mybb

MyBB is a free and open source forum software. The Mail Settings → Additional Parameters for PHP's mail function mailparameters setting value, in connection with the configured mail program's options and behavior, may allow access to sensitive information and Remote Code Execution RCE. The...

CVE-2022-39265 Mail settings' command parameter injection in mybb

MyBB is a free and open source forum software. The Mail Settings → Additional Parameters for PHP's mail function mailparameters setting value, in connection with the configured mail program's options and behavior, may allow access to sensitive information and Remote Code Execution RCE. The...

CVE-2022-39265 Mail settings' command parameter injection in mybb

MyBB is a free and open source forum software. The Mail Settings → Additional Parameters for PHP's mail function mailparameters setting value, in connection with the configured mail program's options and behavior, may allow access to sensitive information and Remote Code Execution RCE. The...

Metasploit Weekly Wrap-Up

Ask and you may receive Module suggestions for the win, this week we see a new module written by jheysel-r7 based on CVE-2022-26352 that happens to have been suggested by jvoisin in the issue queue last month. This module targets an arbitrary file upload in dotCMS versions before 22.03, 5.3.8.10,...

MyBB (prior 1.8.30) Admin Control Remote Code Execution Exploit

This Metasploit module exploits an improper input validation vulnerability in MyBB versions prior to 1.8.30 to execute arbitrary code in the context of the user running the application. The MyBB Admin Control setting page calls the PHP eval function with unsanitized user input. The exploit adds a...

MyBB Admin Control Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'MyBB Admin Control Code Injection RCE', 'Description' = %q This exploit module leverages an improper input validation vulnerability in MyBB prior...

The vulnerability of the Admin CP configuration module of the MyBB forum creation software allows a hacker to execute arbitrary code.

The vulnerability of the Admin CP module for the MyBB forum creation software is related to improper code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Exploit for Code Injection in Mybb

mybb-CVE-2022-24734 MyBB 1.8.29 - Remote Code Execution...

MyBB 1.8.29 - MyBB 1.8.29 - Remote Code Execution (Authenticated) Exploit

Exploit Title: MyBB 1.8.29 - Remote Code Execution RCE Authenticated Exploit Author: Altelus Vendor Homepage: https://mybb.com/ Software Link: https://github.com/mybb/mybb/releases/tag/mybb1829 Version: MyBB 1.8.29 Tested on: Linux CVE : CVE-2022-24734 An RCE can be obtained on MyBB's Admin CP in...

MyBB 1.8.29 Remote Code Execution

Exploit Title: MyBB 1.8.29 - Remote Code Execution RCE Authenticated Date: 2022-05-08 Exploit Author: Altelus Vendor Homepage: https://mybb.com/ Software Link: https://github.com/mybb/mybb/releases/tag/mybb1829 Version: MyBB 1.8.29 Tested on: Linux CVE : CVE-2022-24734 An RCE can be obtained on...