Exploitation Summary
EIP tracks 2 public exploits for CVE-2008-0382. PoCs published by Silentz, waraxe.
AI-analyzed exploit summary This exploit targets a command injection vulnerability in MyBB <= 1.2.10 by manipulating the 'sortby' parameter in forumdisplay.php. It constructs a malicious HTTP GET request to execute arbitrary commands on the server.
Description
Multiple eval injection vulnerabilities in MyBB 1.2.10 and earlier allow remote attackers to execute arbitrary code via the sortby parameter to (1) forumdisplay.php or (2) a results action in search.php.
Exploits (2)
This exploit targets a command injection vulnerability in MyBB <= 1.2.10 by manipulating the 'sortby' parameter in forumdisplay.php. It constructs a malicious HTTP GET request to execute arbitrary commands on the server.
This exploit demonstrates remote code execution in MyBB 1.2.10 via unsanitized input in the 'sortby' parameter, which is passed to an eval() function in both 'forumdisplay.php' and 'search.php'. Attackers can inject arbitrary PHP code to execute system commands or read sensitive files.