CVE-2023-53979: high-severity vulnerability in MyBB
MyBB 1.8.32 Authenticated Remote Code Execution via Chained Vulnerabilities
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
MyBB 1.8.32 allows logged-in administrators to upload malicious files by bypassing upload restrictions and then execute harmful code on the server. This happens because the software doesn't properly validate file uploads and allows editing of settings that control where files are stored.
An authenticated administrator can chain multiple vulnerabilities to achieve RCE: modify upload directory settings via configuration, upload a PHP-embedded image file that bypasses avatar upload validation (CWE-22 path traversal), and execute arbitrary code through the language configuration interface. Requires admin-level privileges but achieves complete code execution on the target system.