MyBB vulnerabilities

MyBB before 1.8.11 allows remote attackers to bypass an SSRF protection mechanism.

MyBB before version 1.8.40 contains a vulnerability in the Contact module that does not properly validate redirect URLs, leading to open redirect and reflected JavaScript code injection.

MyBB from version 1.8.13 to 1.8.40 contains a vulnerability in the installer module that improperly escapes database configuration values, leading to PHP code injection and remote code execution.

MyBB, free and open source forum software, before version 1.8.40 in the User CP Buddy/Ignore List component does not validate reciprocal buddy-list updates correctly. Deleting an entry from the acting user's list updates the target account's buddy list, but the reciprocal search uses the deleted target UID instead of the acting user's UID, and the unchecked array_search() return value can be used as an array key, potentially removing the target account's first stored buddy.

The registration component in MyBB does not validate the text-based Security Question CAPTCHA correctly, allowing attackers to bypass the challenge via a specially crafted value. The question_id field is accepted without verifying if the identifier is valid, and if it is blank, forged, or expired, the request continues without a question-related error.

MyBB before version 1.8.40 does not consistently enforce single-use semantics for the built-in CAPTCHA, allowing remote attackers to bypass CAPTCHA controls through challenge replay. The successful validation paths in contact.php, member.php?action=do_resendactivation, member.php?action=do_lostpw, member.php?action=do_emailuser, and sendthread.php?action=do_sendtofriend do not call captcha::invalidate_captcha() for the default CAPTCHA.

MyBB before version 1.8.40 in the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafted URL. The action=recovery_codes page regenerates Two-Factor Authentication recovery codes on GET requests without request forgery protection.

MyBB prior to 1.8.40, the ACP Users View Manager module does not validate requests correctly, allowing same-site attackers to change a victim administrator's default user list view by embedding a specially crafted URL. The Set as Default control changes the administrator's default view on GET requests without request forgery protection.

MyBB prior to 1.8.40, the ACP Mass Mail module does not validate certain requests correctly, allowing same-site attackers to create draft entries from archived entries by embedding a specially crafted URL. The Resend route duplicates archived mailing entries into new drafts on GET requests without request forgery protection.

MyBB prior to 1.8.40, the Admin CP Security Questions module does not validate the anti-CSRF token correctly, allowing same-site attackers to enable or disable registration challenge questions with a specially crafted URL. The controller processes GET requests for the disable and enable actions without verifying the my_post_key token.

MyBB before version 1.8.40 in the Email User controller does not sanitize sender names correctly, resulting in mail header injection. The fromname parameter is accepted without sanitization, and when mail_handler is set to the default PHP mail value, the sender name is used in Return-Path and Reply-To headers, allowing arbitrary headers to be injected with CRLF sequences.

MyBB before version 1.8.40 in the Mod CP Report Center does not check permissions consistently, allowing moderators without report-management permission to mark reports as resolved. The Mark Selected as Read handler is reachable with canmodcp even without canmanagereportedcontent or canmanagereportedposts, and when no forums are in scope, the UPDATE query executes without the expected permission-based limitation.

MyBB before version 1.8.40 in the remote requests feature does not correctly handle IPv6 addresses, resulting in a server-side request forgery vulnerability. The default disallowed remote hosts list does not include IPv6 addresses, and verification in fetch_remote_file() fails open when get_ip_by_hostname() returns no result for IPv6, allowing a crafted remote target to bypass the host restriction.

MyBB before version 1.8.40 in the calendar module does not validate moderation permissions for the destination calendar when moving events. A user with moderation permission for the source calendar can move an event to a calendar where the user has only viewing permission because the do_move action in calendar.php does not check canmoderateevents for the target calendar.

Prior to version 1.8.40, the calendar module in MyBB does not check permissions consistently when listing calendars, allowing authenticated users to access titles of calendars that are otherwise inaccessible. The affected calendar-selection paths in calendar.php perform permission checks against an invalid calendar context before returning calendar titles. This issue is fixed in version 1.8.40.

Prior to version 1.8.40, the calendar module in MyBB does not verify private event status consistently, allowing users with viewing and moderation permissions to access and moderate private events. The private-event check used by get_events() in inc/functions_calendar.php and the event action is missing from the remaining calendar.php actions, despite the limited-access behavior described in inc/languages/english/calendar.lang.php. This issue is fixed in version 1.8.40.

Prior to version 1.8.40, the Admin CP UTF-8 Conversion module in MyBB does not validate certain requests correctly, allowing same-site attackers to alter table encoding and deny service with a specially crafted URL. The do=all control flow in admin/modules/tools/system_health.php performs ALTER TABLE operations, column rewrite phases, and fulltext index rebuilds on GET requests for the database table named by the table parameter without request verification. This issue is fixed in version 1.8.40.

MyBB before version 1.8.40 has a stored JavaScript code injection vulnerability in checkbox and multiselect profile field types. Profile field validation does not properly handle non-array values, allowing malicious code to be stored and rendered without processing by the MyCode parser.

MyBB before version 1.8.40 has a JavaScript code injection vulnerability in the Buddy/Ignore component due to improper username sanitization. Specially crafted usernames can leave unescaped single quotes, which can be exploited to execute scripts.

MyBB before 1.8.36 allows Code Injection by users with certain high privileges. Templates in Admin CP intentionally use eval, and there was some validation of the input to eval, but type juggling interfered with this when using PCRE within PHP.