CyberRota Analysis
AI-GeneratedThe MyBB forum software versions 1.8.13 to 1.8.40 are vulnerable due to improper escaping of user-supplied database configuration values in the installer module, allowing for PHP code injection and potential remote code execution. Organizations using these versions should prioritize patching to version 1.8.40 or later to mitigate the risk of exploitation, especially if the installer is accessible. This critical vulnerability poses a significant threat to any system running affected versions, making immediate action essential for maintaining security.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not properly escape user-supplied database configuration values written to the configuration file, resulting in PHP code injection and remote code execution when the installer is available. install/index.php processes the values with addcslashes(), but the $characters argument added in MyBB 1.8.13 does not include the backslash character, allowing crafted input to escape the generated PHP string. The uniquely identifying implementation details include introduced in MyBB 1.8.13. This issue is fixed in version 1.8.40.