CVE-2022-39265: Mail settings' command parameter injection in mybb
MyBB is a free and open source forum software. The Mail Settings ? Additional Parameters for PHP's mail() function mailparameters setting value, in connection with the configured mail program's options and behavior, may allow access to sensitive information and Remote Code Execution (RCE). The vulnerable module requires Admin CP access with the Can manage settings? permission and may depend on configured file permissions. MyBB 1.8.31 resolves this issue with the commit 0cd318136a. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Other sources
MyBB is a free and open source forum software. The Mail Settings → Additional Parameters for PHP's mail() function mailparameters setting value, in connection with the configured mail program's options and behavior, may allow access to sensitive information and Remote Code Execution (RCE). The vulnerable module requires Admin CP access with the Can manage settings? permission and may depend on configured file permissions. MyBB 1.8.31 resolves this issue with the commit 0cd318136a. Users are advised to upgrade. There are no known workarounds for this vulnerability.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-39265?
CVE-2022-39265 is a vulnerability in MyBB, a free and open source forum software, that allows access to sensitive information and potentially enables Remote Code Execution (RCE) through the Mail Settings-Additional Parameters for PHP's mail() function mail_parameters setting value.
What is the severity of CVE-2022-39265?
The severity of CVE-2022-39265 is high with a CVSS score of 7.2.
Which software versions are affected by CVE-2022-39265?
MyBB versions up to and excluding 1.8.31 are affected by CVE-2022-39265.
How can CVE-2022-39265 be exploited?
An attacker can exploit CVE-2022-39265 by manipulating the Mail Settings-Additional Parameters for PHP's mail() function mail_parameters setting value and the configured mail program's options to access sensitive information and potentially execute remote code.
Is there a fix available for CVE-2022-39265?
Yes, a fix for CVE-2022-39265 is available. It is recommended to update MyBB to version 1.8.31 or newer to mitigate this vulnerability.