PT-2022-27015 · Mybb · Mybb

Vz · Published 2022-11-21 · Updated 2024-03-06 · CVE-2022-43709

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions MyBB version 1.8.31

Description The issue allows remote authenticated users to modify the query string via direct user input or stored search filter settings in the Admin CP's Users module, resulting in a SQL injection vulnerability.

Recommendations For MyBB version 1.8.31, consider restricting access to the Admin CP's Users module until a patch is available. As a temporary workaround, avoid using direct user input or stored search filter settings in the affected module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

SQL injection

Weakness Enumeration

CWE-79

CWE-89

Related Identifiers

BIT-MYBB-2022-43709

CVE-2022-43709

GHSA-GGP5-454P-867V

Affected Products

Mybb

References · 8

• https://github.com/mybb/mybb/security/advisories/GHSA-ggp5-454p-867v · Patch
• https://osv.dev/vulnerability/BIT-mybb-2022-43709 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-43709 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43709 · Security Note
• https://t.me/cvenotify/38181 · Telegram Post
• https://mybb.com · Note
• https://t.me/cvenotify/38220 · Telegram Post
• https://t.me/cibsecurity/53296 · Telegram Post