PT-2009-6570 · Mybb · Mybb

Hanno Böck · Published 2009-12-29 · Updated 2025-09-26 · CVE-2009-4449

Positive Technologies (AI Summary)

CVSS v2.0

6.3

Medium

Base vector

AV:N/AC:M/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions MyBB versions 1.4.10 and earlier

Description The issue allows remote authenticated users to determine the existence of files via directory traversal sequences in the avatar and possibly the gallery parameters when changing the user avatar from the gallery. This is related to the files (1) admin/modules/user/users.php and (2) usercp.php.

Recommendations For MyBB versions 1.4.10 and earlier, as a temporary workaround, consider restricting access to the avatar and gallery parameters in the usercp.php file until a patch is available. Additionally, limiting the ability to change the user avatar from the gallery may help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2009-4449

Affected Products

Mybb

References · 15

• 🔥 http://dev.mybboard.net/projects/mybb/repository/revisions/4663/diff/branches/1.4-stable/admin/modules/user/users.php · Exploit
• 🔥 http://dev.mybboard.net/projects/mybb/repository/revisions/4663/diff/branches/1.4-stable/usercp.php · Exploit
• http://secunia.com/advisories/37906 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4449 · Security Note
• http://vupen.com/english/advisories/2009/3651 · Vendor Advisory
• http://securityfocus.com/bid/37489 · Note
• https://t.me/cveNotify/136640 · Telegram Post
• http://dev.mybboard.net/issues/617 · Note
• http://osvdb.org/61359 · Note
• http://openwall.com/lists/oss-security/2010/10/11/8 · Note
• http://openwall.com/lists/oss-security/2010/10/08/7 · Note
• http://blog.mybboard.net/2009/12/29/mybb-1-4-11-released-minor-patch-security-update · Note
• http://openwall.com/lists/oss-security/2010/12/06/2 · Note
• https://t.me/cvenotify/68911 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4449 · Note