CVE-2022-39265: high-severity vulnerability in mybb
Mail settings' command parameter injection in mybb
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
MyBB forum software allows administrators with settings management permissions to inject commands through mail configuration parameters, potentially leading to sensitive information disclosure or remote code execution on the server.
CWE-74 command injection vulnerability in MyBB's mail settings parameter handling. Requires Admin CP access with settings management permission. Attacker can inject arbitrary commands through the mail_parameters setting, which are passed unsanitized to PHP's mail() function, enabling RCE or information disclosure depending on mail program configuration and file permissions.
In the same product, most dangerous first.