CVEvulnerability

CVE-2021-43281

7.2 HIGH Published 2021-11-04 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-11-04
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
Weaknesses
CWE-94

Description

MyBB before 1.8.29 allows Remote Code Injection by an admin with the "Can manage settings?" permission. The Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type "php" with PHP code, executed on Change Settings pages.

Affected configurations

• mybb mybb (>= 1.2.0 < 1.8.29)

Related

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References