Description
MyBB (MyBulletinBoard) 1.1.0 does not set the constant KILL_GLOBAL variable in (1) global.php and (2) inc/init.php, which allows remote attackers to initialize arbitrary variables that are processed by an @extract command, which could then be leveraged to conduct cross-site scripting (XSS) or SQL injection attacks.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- MyBB 1.1 - Global Variable Overwrite EDB-27667 · webapps · Apr 17, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- mybb-global-init-data-manipulation(25865) vdb-entry
- 24710 vdb-entry
- 19668 third-party-advisory
- ADV-2006-1381 vdb-entry
- http://community.mybboard.net/showthread.php?tid=8232
- 20060415 [KAPDA]MyBB1.1.0~global.php~ParameterExtracting mailing-list
- 24711 vdb-entry
- http://myimei.com/security/2006-04-14/mybb110globalphpparameterextracting.html