Description

MyBB before 1.8.29 allows Remote Code Injection by an admin with the "Can manage settings?" permission. The Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type "php" with PHP code, executed on Change Settings pages.

Remediation

References

CVE-2021-43281

Related Vulnerabilities

Microsoft SQL Server CVE-2023-21528 Vulnerability (CVE-2023-21528)

Apache HTTP Server Other Vulnerability (CVE-2007-1742)

WordPress Plugin MiwoFTP-File & Folder Manager Multiple Vulnerabilities (1.0.5)

WordPress Plugin Location Weather Cross-Site Scripting (1.3.3)

WordPress Plugin Youzify-BuddyPress Community, User Profile, Social Network & Membership for WordPress SQL Injection (1.2.5)

Severity

High

Classification

CVE-2021-43281 CWE-94 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities