PT-2025-52716 · Mybb · Mybb

Luc1F3R11 · Publicado 2025-12-22 · Atualizado 2025-12-27 · CVE-2023-53979

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MyBB version 1.8.32

Description MyBB version 1.8.32 contains a chained issue that allows authenticated administrators to bypass avatar upload restrictions and potentially execute arbitrary code. Attackers can modify upload path settings, upload a malicious PHP-embedded image file, and execute commands through the language configuration editing interface. The vulnerability involves bypassing restrictions on avatar uploads, which can lead to the execution of unauthorized code.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Correção

RCE

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2023-53979

Produtos afetados

Mybb

Referências · 14

• 🔥 https://fdlucifer.github.io/2023/01/17/mybb1-8-32-LFI-RCE · Exploit
• 🔥 https://exploit-db.com/exploits/51213 · Exploit
• 🔥 https://vulncheck.com/advisories/mybb-authenticated-remote-code-execution-via-chained-vulnerabilities · Exploit
• https://t.me/cveNotify/146945 · Publicação no Telegram
• https://twitter.com/TheHackerWire/status/2003250118573674890 · Publicação no Twitter
• https://mybb.com · Nota
• https://cve.org/CVERecord?id=CVE-2022-45867 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-53979 · Nota de Segurança
• https://twitter.com/CVEnew/status/2003233939457282155 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-53979 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2003270430010814847 · Publicação no Twitter
• https://t.me/CVEtracker/40447 · Publicação no Telegram
• https://twitter.com/CveFindCom/status/2003233944909586801 · Publicação no Twitter
• https://t.me/cveNotify/146896 · Publicação no Telegram