PT-2025-33087 · Mybb · Mybb

Published 2025-08-13 · Updated 2025-08-14 · CVE-2011-10018

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: myBB version 1.6.4

Description: myBB version 1.6.4 was distributed with an unauthorized backdoor embedded in the source code. This backdoor allowed remote attackers to execute arbitrary PHP code by injecting payloads into a specially crafted collapsed cookie. The vulnerability was introduced during packaging and was not part of the intended application logic. Exploitation does not require authentication and results in full compromise of the web server in the context of the web application.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Hidden Functionality

Code Injection

Weakness Enumeration

CWE-912

CWE-94

Related Identifiers

CVE-2011-10018

Affected Products

Mybb

References · 8

• 🔥 https://exploit-db.com/exploits/17949 · Exploit
• https://blog.mybb.com/2011/10/06/1-6-4-security-vulnerabilit · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-10018 · Security Note
• https://t.me/cveNotify/132254 · Telegram Post
• https://web.archive.org/web/20111015224948/http://secunia.com/advisories/46300 · Note
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/mybb_backdoor.rb · Note
• https://t.me/CVEtracker/29934 · Telegram Post
• https://vulncheck.com/advisories/mybb-backdoor-arbitrary-command-execution · Note