PT-2018-10619 · Mybb · Moderator Log Notes Plugin

0Xb9 · Published 2018-08-24 · Updated 2018-10-31 · CVE-2018-11502

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Moderator Log Notes plugin version 1.1 for MyBB

Description The issue allows an attacker to remotely delete all moderator notes and logs in the moderator control panel (modCP) and administrator control panel (ACP) via a Cross-Site Request Forgery (CSRF) attack. This enables unauthorized modification of sensitive data.

Recommendations For Moderator Log Notes plugin version 1.1, consider implementing CSRF protection mechanisms to prevent unauthorized requests. As a temporary workaround, restrict access to the modCP and ACP to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2018-11502

Affected Products

Moderator Log Notes Plugin

References · 4

• 🔥 https://exploit-db.com/exploits/45224 · Exploit
• 🔥 https://packetstormsecurity.com/files/148999/MyBB-Moderator-Log-Notes-1.1-Cross-Site-Request-Forgery.html · Exploit
• https://osv.dev/vulnerability/CVE-2018-11502 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-11502 · Security Note