CVE-2019-12831 File upload in n/a
Attackers can upload malicious PHP files by exploiting MySQL string truncation during theme imports, leading to remote code execution on MyBB forums.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-12831?
CVE-2019-12831 is a high-severity vulnerability in Mybb Mybb, published on 15 Jun 2019. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
In MyBB before 1.8.21, an attacker can abuse a default behavior of MySQL on many systems (that leads to truncation of strings that are too long for a database column) to create a PHP shell in the cache directory of a targeted forum via a crafted XML import, as demonstrated by truncation of aaaaaaaaaaaaaaaaaaaaaaaaaa.php.css to aaaaaaaaaaaaaaaaaaaaaaaaaa.php with a 30-character limit, aka theme import stylesheet name RCE.
Weakness: CWE-20
Which versions are affected by CVE-2019-12831?
It affects 1 product.
Products include Mybb Mybb.
How do I fix CVE-2019-12831?
No fix has been published for CVE-2019-12831 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-12831 being exploited?
There is no known exploitation of CVE-2019-12831 in the wild and no public exploit code.
Other vulnerabilities in Mybb Mybb
Sources
Also known as GHSA-76pq-5fjf-j6xg.