CVE-2022-39265 Mail settings' command parameter injection in mybb
An admin with settings permissions can inject commands via mail parameters, leading to remote code execution and information disclosure.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-39265?
CVE-2022-39265 is a high-severity command injection vulnerability in Mybb Mybb, published on 6 Oct 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
MyBB is a free and open source forum software. The _Mail Settings_ → Additional Parameters for PHP's mail() function mail_parameters setting value, in connection with the configured mail program's options and behavior, may allow access to sensitive information and Remote Code Execution (RCE). The vulnerable module requires Admin CP access with the `_Can manage settings?_` permission and may depend on configured file permissions. MyBB 1.8.31 resolves this issue with the commit `0cd318136a`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Which versions are affected by CVE-2022-39265?
1 open source package ship an affected version, including mybb. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mybb Bitnami | All versions | 1.8.31 |
Products include Mybb Mybb.
How do I fix CVE-2022-39265?
Upgrade mybb to 1.8.31 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2022-39265 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-39265 exists.
Other vulnerabilities in Mybb Mybb
Sources
Also known as BIT-mybb-2022-39265, GHSA-hxhm-rq9f-7xj7.