MyBB CVE-2017-8104 Directory Traversal Vulnerability
BID:98045
Info
MyBB CVE-2017-8104 Directory Traversal Vulnerability
| Bugtraq ID: | 98045 |
| Class: | Input Validation Error |
| CVE: |
CVE-2017-8104 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 24 2017 12:00AM |
| Updated: | May 02 2017 01:11AM |
| Credit: | Zhiyang Zeng |
| Vulnerable: |
MyBB MyBB 1.8.8 MyBB MyBB 1.8.7 MyBB MyBB 1.8.6 MyBB MyBB 1.8.5 MyBB MyBB 1.8.4 MyBB MyBB 1.8.3 MyBB MyBB 1.8.2 MyBB MyBB 1.8.1 MyBB MyBB 1.6.16 MyBB MyBB 1.6.14 MyBB MyBB 1.6.13 MyBB MyBB 1.6.11 MyBB MyBB 1.6.10 MyBB MyBB 1.6.9 MyBB MyBB 1.6.8 MyBB MyBB 1.6.7 MyBB MyBB 1.6.6 MyBB MyBB 1.6.5 MyBB MyBB 1.6.4 MyBB MyBB 1.6.3 MyBB MyBB 1.6.2 MyBB MyBB 1.6.1 MyBB MyBB 1.4.16 MyBB MyBB 1.4.15 MyBB MyBB 1.4.14 MyBB MyBB 1.4.10 MyBB MyBB 1.4.9 MyBB MyBB 1.4.8 MyBB MyBB 1.4.7 MyBB MyBB 1.4.6 MyBB MyBB 1.4.5 MyBB MyBB 1.4.3 MyBB MyBB 1.4.2 MyBB MyBB 1.2.14 MyBB MyBB 1.2.12 MyBB MyBB 1.2.2 MyBB MyBB 1.2.1 MyBB MyBB 1.2 MyBB MyBB 1.1.3 MyBB MyBB 1.1 MyBB MyBB 1.6.12 MyBB MyBB 1.6.0 MyBB MyBB 1.6 MyBB MyBB 1.5.2 MyBB MyBB 1.5.1 MyBB MyBB 1.4.4 MyBB MyBB 1.4.13 MyBB MyBB 1.4.12 MyBB MyBB 1.4.11 MyBB MyBB 1.4.1 MyBB MyBB 1.2.9 MyBB MyBB 1.2.8 MyBB MyBB 1.2.7 MyBB MyBB 1.2.6 MyBB MyBB 1.2.5 MyBB MyBB 1.2.4 MyBB MyBB 1.2.3 MyBB MyBB 1.2.13 MyBB MyBB 1.2.11 MyBB MyBB 1.2.10 MyBB MyBB 1.1.8 MyBB MyBB 1.1.7 MyBB MyBB 1.1.6 MyBB MyBB 1.1.5 MyBB MyBB 1.1.4 MyBB MyBB 1.1.2 MyBB MyBB 1.1.1 MyBB MyBB 1.04 MyBB MyBB 1.03 MyBB MyBB 1.02 MyBB MyBB 1.01 MyBB MyBB 1.00 |
| Not Vulnerable: |
MyBB MyBB 1.8.11 |
Discussion
MyBB CVE-2017-8104 Directory Traversal Vulnerability
MyBB is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input.
An attacker can exploit this issue using directory-traversal characters ('../') to access or read arbitrary files that contain sensitive information or to access files outside of the restricted directory to obtain sensitive information and perform other attacks.
Versions prior to MyBB 1.8.11 are vulnerable.
MyBB is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input.
An attacker can exploit this issue using directory-traversal characters ('../') to access or read arbitrary files that contain sensitive information or to access files outside of the restricted directory to obtain sensitive information and perform other attacks.
Versions prior to MyBB 1.8.11 are vulnerable.
Exploit / POC
MyBB CVE-2017-8104 Directory Traversal Vulnerability
Attackers can exploit this issue using browser or readily available tools.
Attackers can exploit this issue using browser or readily available tools.
Solution / Fix
MyBB CVE-2017-8104 Directory Traversal Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
MyBB CVE-2017-8104 Directory Traversal Vulnerability
References:
References:
- MyBB Homepage (MyBB)
- MyBB 1.8.11 & Merge System 1.8.11 Release (MyBB)