Description

In MyBB before 1.8.21, an attacker can abuse a default behavior of MySQL on many systems (that leads to truncation of strings that are too long for a database column) to create a PHP shell in the cache directory of a targeted forum via a crafted XML import, as demonstrated by truncation of aaaaaaaaaaaaaaaaaaaaaaaaaa.php.css to aaaaaaaaaaaaaaaaaaaaaaaaaa.php with a 30-character limit, aka theme import stylesheet name RCE.

Remediation

References

CVE-2019-12831

Related Vulnerabilities

osCommerce Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2002-1991)

Django Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2015-2241)

WebLogic CVE-2020-14687 Vulnerability (CVE-2020-14687)

Ruby Inefficient Regular Expression Complexity Vulnerability (CVE-2023-22795)

WordPress Plugin Widget Control Powered By Everyblock Cross-Site Scripting (1.0.1)

Severity

High

Classification

CVE-2019-12831 CWE-20 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities