Description
MyBB 1.8.32 contains a chained vulnerability that allows authenticated administrators to bypass avatar upload restrictions and execute arbitrary code. Attackers can modify upload path settings, upload a malicious PHP-embedded image file, and execute commands through the language configuration editing interface.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Mybb | MyBB | MyBB 1.8.32 | — |
References
- ExploitDB-51213 exploit
- Official MyBB Vendor Homepage product
- Researcher Disclosure technical-description
- VulnCheck Advisory: MyBB 1.8.32 Authenticated Remote Code Execution via Chained Vulnerabilities third-party-advisory