CVE-2023-53979: MyBB 1.8.32 Authenticated Remote Code Execution via Chained Vulnerabilities
MyBB 1.8.32 contains a chained vulnerability that allows authenticated administrators to bypass avatar upload restrictions and execute arbitrary code. Attackers can modify upload path settings, upload a malicious PHP-embedded image file, and execute commands through the language configuration editing interface.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-53979?
CVE-2023-53979 is considered a critical vulnerability due to its ability to allow authenticated administrators to execute arbitrary code.
How do I fix CVE-2023-53979?
To fix CVE-2023-53979, update your MyBB installation to the latest version where the vulnerability is patched.
What does CVE-2023-53979 allow an attacker to do?
CVE-2023-53979 allows an attacker with administrative access to upload a malicious PHP-embedded image file and execute arbitrary commands.
Can CVE-2023-53979 be exploited without authentication?
No, CVE-2023-53979 requires that the attacker has authenticated administrative access to exploit the vulnerability.
Which versions of MyBB are affected by CVE-2023-53979?
CVE-2023-53979 specifically affects MyBB version 1.8.32.