Several vulnerabilities have been identified in the free web forum engine MyBB, which, when combined, allow for the execution of PHP code on the server. The issues manifest in releases from 1.8.16 to 1.8.25 and have been resolved in the MyBB 1.8.26 update.
The first vulnerability (CVE-2021-27889) allows an unauthenticated forum user to embed JavaScript code into posts, discussions, and private messages. The forum permits the addition of images, lists, and multimedia data through special tags, which are converted into HTML markup. Due to a bug in the code that transforms such tags, the structure with a double URL [img]http://xyzsomething.com/image?)http://x.com/onerror=alert(1);//[/img] is converted into <img src="»http://xyzsomething.com/image?)<a" href="»" http:="»»" x.com="»»" onerror="»alert(1);//"»" target="»_blank»" rel="»noopener»" class="»mycode_url»">
The second vulnerability (CVE-2021-27890) allows for the injection of SQL commands, enabling code execution. This problem arises from the substitution of $theme[‘templateset’] in the SQL query body without proper sanitization, along with the execution of components ${…} through the eval call. For example, one can initiate the execution of the PHP command passthru(‘ls’) when processing a theme with a structure like: <templateset>’) AND 1=0 UNION SELECT title, ‘${passthru(\’ls\’)}’ from mybb_templates — <\/templateset>
To exploit the second vulnerability, a session with forum administrator rights is required. An attacker can leverage the first vulnerability to send a private message containing JavaScript code to the administrator, which will trigger the second vulnerability when viewed.
Source: opennet.ru
