PT-2022-2581 · Mybb · Mybb

Cillian Collins

·

Published

2022-03-09

·

Updated

2024-03-06

·

CVE-2022-24734

CVSS v2.0

9.0

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.30
Description The issue is related to the Admin CP's Settings management module, which does not validate setting types correctly on insertion and update. This allows an attacker to add settings of supported type php with PHP code, executed on Change Settings pages, resulting in a Remote Code Execution (RCE) vulnerability. The vulnerable module requires Admin CP access with the Can manage settings? permission. MyBB's Settings module stores setting data in an options code string ($options code; mybb settings.optionscode database column) that identifies the setting type and its options, separated by a new line character ( ). The vulnerability can be exploited by remote attackers who have authentication access to the Control Panel.
Recommendations For MyBB versions prior to 1.8.30, update to version 1.8.30 to resolve the issue. As a temporary workaround, consider restricting access to the Admin CP's Settings management module to minimize the risk of exploitation. Additionally, restrict the use of the php setting type until the issue is resolved.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

Related Identifiers

BDU:2022-03029
BIT-MYBB-2022-24734
CVE-2022-24734
GHSA-876V-GWGH-W57F
ZDI-22-503

Affected Products

Mybb