Description
The domecode function in inc/functions_post.php in MyBulletinBoard (MyBB) 1.1.2, and possibly other versions, allows remote attackers to execute arbitrary PHP code via the username field, which is used in a preg_replace function call with a /e (executable) modifier.
Exploits (1)
exploitdb
WORKING POC
VERIFIED
by Javier Olascoaga · perlwebappsphp
https://www.exploit-db.com/exploits/1909
References (11)
Scores
EPSS
0.1141
EPSS Percentile
93.6%
Details
Status
published
Products (1)
mybulletinboard/mybulletinboard
1.1.2
Published
Jun 13, 2006
Tracked Since
Feb 18, 2026