Description
myBB version 1.6.4 was distributed with an unauthorized backdoor embedded in the source code. The backdoor allowed remote attackers to execute arbitrary PHP code by injecting payloads into a specially crafted collapsed cookie. This vulnerability was introduced during packaging and was not part of the intended application logic. Exploitation requires no authentication and results in full compromise of the web server under the context of the web application.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| myBB Group | Forum Software | 1.6.4 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
myBB 1.6.4 Backdoor Arbitrary Command Execution
exploit/unix/webapp/mybb_backdoor
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/mybb_backdoor.rb exploit
- https://www.exploit-db.com/exploits/17949 exploit
- https://web.archive.org/web/20111015224948/http://secunia.com/advisories/46300/ third-party-advisory
- https://blog.mybb.com/2011/10/06/1-6-4-security-vulnerabilit/ vendor-advisory patch
- https://www.vulncheck.com/advisories/mybb-backdoor-arbitrary-command-execution third-party-advisory