PT-2023-5287 · Mybb · Mybb

Emmet Leahy · Publicado 2023-08-12 · Atualizado 2024-03-06 · CVE-2023-41362

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.36

Description The issue is related to code injection by users with certain high privileges in the MyBB software. Templates in the Admin CP intentionally use eval, and there was some validation of the input to eval, but type juggling interfered with this when using PCRE within PHP. This can allow a remote attacker to execute arbitrary code.

Recommendations For MyBB versions prior to 1.8.36, update to version 1.8.36 or later to resolve the issue. As a temporary workaround, consider restricting access to the Admin CP templates that use eval to minimize the risk of exploitation.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

BDU:2023-05912

BIT-MYBB-2023-41362

CVE-2023-41362

GHSA-PR74-WVP3-Q6F5

Produtos afetados

Mybb

Referências · 16

• 🔥 https://github.com/SorceryIE/CVE-2023-41362_MyBB_ACP_RCE · Exploit
• https://github.com/mybb/mybb/security/advisories/GHSA-pr74-wvp3-q6f5 · Correção
• https://github.com/mybb/mybb/commit/a43a6f22944e769a6eabc58c39e7bc18c1cab4ca.patch · Correção
• https://twitter.com/CVEnew/status/1696542190359421218 · Publicação no Twitter
• https://twitter.com/piedpiper1616/status/1701475160887550287 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-41362 · Aviso do Fabricante
• https://t.me/s_e_reborn/4443 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2023-05912 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-41362 · Nota de Segurança
• https://mybb.com/versions/1.8.36 · Nota
• https://osv.dev/vulnerability/BIT-mybb-2023-41362 · Aviso do Fabricante
• https://blog.sorcery.ie/posts/mybb_acp_rce · Nota
• https://t.me/cybersecuritytechnologies/9010 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1696591976915705938 · Publicação no Twitter
• https://t.me/cibsecurity/69367 · Publicação no Telegram