PT-2023-5287 · Mybb · Mybb

Emmet Leahy · Published 2023-08-12 · Updated 2024-03-06 · CVE-2023-41362

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.36

Description The issue is related to code injection by users with certain high privileges in the MyBB software. Templates in the Admin CP intentionally use eval, and there was some validation of the input to eval, but type juggling interfered with this when using PCRE within PHP. This can allow a remote attacker to execute arbitrary code.

Recommendations For MyBB versions prior to 1.8.36, update to version 1.8.36 or later to resolve the issue. As a temporary workaround, consider restricting access to the Admin CP templates that use eval to minimize the risk of exploitation.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2023-05912

BIT-MYBB-2023-41362

CVE-2023-41362

GHSA-PR74-WVP3-Q6F5

Affected Products

Mybb

References · 16

• 🔥 https://github.com/SorceryIE/CVE-2023-41362_MyBB_ACP_RCE · Exploit
• https://github.com/mybb/mybb/security/advisories/GHSA-pr74-wvp3-q6f5 · Patch
• https://github.com/mybb/mybb/commit/a43a6f22944e769a6eabc58c39e7bc18c1cab4ca.patch · Patch
• https://osv.dev/vulnerability/CVE-2023-41362 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05912 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-41362 · Security Note
• https://osv.dev/vulnerability/BIT-mybb-2023-41362 · Vendor Advisory
• https://twitter.com/CVEnew/status/1696542190359421218 · Twitter Post
• https://twitter.com/piedpiper1616/status/1701475160887550287 · Twitter Post
• https://t.me/s_e_reborn/4443 · Telegram Post
• https://mybb.com/versions/1.8.36 · Note
• https://blog.sorcery.ie/posts/mybb_acp_rce · Note
• https://t.me/cybersecuritytechnologies/9010 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1696591976915705938 · Twitter Post
• https://t.me/cibsecurity/69367 · Telegram Post