Exploitation Summary
EIP tracks 4 public exploits for CVE-2022-24734.
PoCs published by Altelus, Altelus1, lavclash75, including Metasploit module exploits/multi/http/mybb_rce_cve_2022_24734.
AI-analyzed exploit summary This exploit leverages a vulnerability in MyBB's Admin CP to achieve RCE by injecting malicious PHP code into the 'Add New Setting' feature. It requires admin credentials and exploits insufficient input validation in the 'type' parameter.
Description
MyBB is a free and open source forum software. In affected versions the Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type `php` with PHP code, executed on on _Change Settings_ pages. This results in a Remote Code Execution (RCE) vulnerability. The vulnerable module requires Admin CP access with the `Can manage settings?` permission. MyBB's Settings module, which allows administrators to add, edit, and delete non-default settings, stores setting data in an options code string ($options_code; mybb_settings.optionscode database column) that identifies the setting type and its options, separated by a new line character (\n). In MyBB 1.2.0, support for setting type php was added, for which the remaining part of the options code is PHP code executed on Change Settings pages (reserved for plugins and internal use). MyBB 1.8.30 resolves this issue. There are no known workarounds.
Exploits (4)
This exploit leverages a vulnerability in MyBB's Admin CP to achieve RCE by injecting malicious PHP code into the 'Add New Setting' feature. It requires admin credentials and exploits insufficient input validation in the 'type' parameter.
This PoC exploits CVE-2022-24734, an RCE vulnerability in MyBB's Admin CP by injecting malicious PHP code into the 'Add New Setting' feature. It leverages command injection via the 'extra' field in the configuration settings.
This is a functional exploit for CVE-2022-24734, targeting MyBB 1.8.29. It leverages an authenticated RCE vulnerability in the Admin CP's 'Add New Setting' feature by injecting malicious PHP code into the 'extra' field of a new setting.
This Metasploit module exploits an improper input validation vulnerability in MyBB prior to 1.8.30, allowing authenticated administrators to execute arbitrary code via PHP `eval` function. The exploit adds a malicious setting, injects the payload, and triggers execution.
References (6)
Scores
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H