MyBB up to 1.8.30 Mail Settings mail mail_parameters injection

Summaryinfo

A vulnerability described as problematic has been identified in MyBB up to 1.8.30. This vulnerability affects the function mail of the component Mail Settings. The manipulation of the argument mail_parameters results in injection. This vulnerability is known as CVE-2022-39265. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as problematic, was found in MyBB up to 1.8.30 (Content Management System). Affected is the function mail of the component Mail Settings. The manipulation of the argument mail_parameters with an unknown input leads to a injection vulnerability. CWE is classifying the issue as CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

MyBB is a free and open source forum software. The _Mail Settings_ → Additional Parameters for PHP's mail() function mail_parameters setting value, in connection with the configured mail program's options and behavior, may allow access to sensitive information and Remote Code Execution (RCE). The vulnerable module requires Admin CP access with the `_Can manage settings?_` permission and may depend on configured file permissions. MyBB 1.8.31 resolves this issue with the commit `0cd318136a`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The weakness was published 10/06/2022 as GHSA-hxhm-rq9f-7xj7. The advisory is shared for download at github.com. This vulnerability is traded as CVE-2022-39265. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1055.

Upgrading to version 1.8.31 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2022-41774). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Content Management System

Name

• MyBB

Version

• 1.8.0
• 1.8.1
• 1.8.2
• 1.8.3
• 1.8.4
• 1.8.5
• 1.8.6
• 1.8.7
• 1.8.8
• 1.8.9
• 1.8.10
• 1.8.11
• 1.8.12
• 1.8.13
• 1.8.14
• 1.8.15
• 1.8.16
• 1.8.17
• 1.8.18
• 1.8.19
• 1.8.20
• 1.8.21
• 1.8.22
• 1.8.23
• 1.8.24
• 1.8.25
• 1.8.26
• 1.8.27
• 1.8.28
• 1.8.29
• 1.8.30

License

• open-source

Website

• Product: https://mybb.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion