CVE-2021-27890

This exploit chains a stored XSS (CVE-2021-27889) with a second-order SQL injection (CVE-2021-27890) in MyBB 1.8.25 to achieve remote command execution via improper string interpolation in eval(). It requires an admin with a valid ACP session to trigger the payload.

This PoC exploits CVE-2021-27890 (SQL injection) and CVE-2021-27889 (XSS) in MyBB to achieve remote code execution by injecting malicious XML theme data and triggering file write via SQLi.