PT-2022-24855 · Mybb · Mybb

Vz · Published 2022-10-06 · Updated 2024-03-06 · CVE-2022-39265

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.31

Description The issue in MyBB allows access to sensitive information and Remote Code Execution (RCE) through the mail parameters setting value in the Mail Settings → Additional Parameters for PHP's mail() function, in connection with the configured mail program's options and behavior. This requires Admin CP access with the Can manage settings? permission and may depend on configured file permissions.

Recommendations For MyBB versions prior to 1.8.31, upgrade to version 1.8.31 or later to resolve the issue. As a temporary workaround, consider restricting access to the Admin CP and limiting the Can manage settings? permission to minimize the risk of exploitation.

Exploit

Fix

RCE

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

Related Identifiers

BIT-MYBB-2022-39265

CVE-2022-39265

GHSA-HXHM-RQ9F-7XJ7

Affected Products

Mybb

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39265.json · Exploit
• 🔥 https://github.com/mybb/mybb/blob/mybb_1830/install/resources/settings.xml#L2331-L2338 · Exploit
• https://github.com/mybb/mybb/commit/0cd318136a10b029bb5c8a8f6dddf39d87519797 · Patch
• https://osv.dev/vulnerability/BIT-mybb-2022-39265 · Vendor Advisory
• https://mybb.com/versions/1.8.31 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39265 · Security Note
• https://osv.dev/vulnerability/CVE-2022-39265 · Vendor Advisory
• https://github.com/mybb/mybb/security/advisories/GHSA-hxhm-rq9f-7xj7 · Note