CVE-2023-41362

EUVD-2023-45865
MyBB before 1.8.36 allows Code Injection by users with certain high privileges. Templates in Admin CP intentionally use eval, and there was some validation of the input to eval, but type juggling interfered with this when using PCRE within PHP.
Code Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.2 HIGH
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 95%
Affected Products (NVD)
VendorProductVersion
mybbmybb
𝑥
< 1.8.36
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://blog.sorcery.ie/posts/mybb_acp_rce/
https://github.com/mybb/mybb/commit/a43a6f22944e769a6eabc58c39e7bc18c1cab4ca.patch
https://github.com/mybb/mybb/security/advisories/GHSA-pr74-wvp3-q6f5
https://mybb.com/versions/1.8.36/
https://blog.sorcery.ie/posts/mybb_acp_rce/
https://github.com/mybb/mybb/commit/a43a6f22944e769a6eabc58c39e7bc18c1cab4ca.patch
https://github.com/mybb/mybb/security/advisories/GHSA-pr74-wvp3-q6f5
https://mybb.com/versions/1.8.36/