CVE-2021-43281

Published: Nov 4, 2021Modified: Nov 21, 2024

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: NVD

Description

MyBB before 1.8.29 allows Remote Code Injection by an admin with the "Can manage settings?" permission. The Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type "php" with PHP code, executed on Change Settings pages.

Affected (1)

Products: Mybb: Mybb

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Mybb Mybb	From 1.2.0 to 1.8.29

Related CWEs

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (2)

https://github.com/mybb/mybb/security/advisories/GHSA-8gxx-vmr9-h39p

Source: cve@mitre.org

PatchRelease NotesThird Party Advisory

https://github.com/mybb/mybb/security/advisories/GHSA-8gxx-vmr9-h39p

Source: af854a3a-2127-422b-91ae-364da2661108

PatchRelease NotesThird Party Advisory

Timeline

No history available yet.