CVE-2011-10018: myBB 1.6.4 Backdoor Arbitrary Command Execution
myBB version 1.6.4 was distributed with an unauthorized backdoor embedded in the source code. The backdoor allowed remote attackers to execute arbitrary PHP code by injecting payloads into a specially crafted collapsed cookie. This vulnerability was introduced during packaging and was not part of the intended application logic. Exploitation requires no authentication and results in full compromise of the web server under the context of the web application.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-10018?
CVE-2011-10018 is considered a critical vulnerability due to the presence of a backdoor that allows remote code execution.
How do I fix CVE-2011-10018?
To fix CVE-2011-10018, upgrade to a patched version of myBB that does not include the backdoor in the source code.
What systems are affected by CVE-2011-10018?
CVE-2011-10018 affects myBB version 1.6.4, which includes the unauthorized backdoor in its codebase.
What are the risks associated with CVE-2011-10018?
The risks associated with CVE-2011-10018 include unauthorized remote access and control of the affected myBB installations.
How was CVE-2011-10018 introduced?
CVE-2011-10018 was introduced during the packaging process of myBB version 1.6.4, leading to the inclusion of a malicious backdoor.