CVE-2019-12831

In MyBB before 1.8.21, an attacker can abuse a default behavior of MySQL on many systems (that leads to truncation of strings that are too long for a database column) to create a PHP shell in the cache directory of a targeted forum via a crafted XML import, as demonstrated by truncation of aaaaaaaaaaaaaaaaaaaaaaaaaa.php.css to aaaaaaaaaaaaaaaaaaaaaaaaaa.php with a 30-character limit, aka theme import stylesheet name RCE.

CVSS v3 7.2 HIGH
CVSS v2.0 6.5 MEDIUM

7.2^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://blog.mybb.com/2019/06/10/mybb-1-8-21-released-security-maintenance-release/	Release Notes Vendor Advisory
https://blog.ripstech.com/2019/mybb-stored-xss-to-rce/	Exploit Vendor Advisory
https://blog.mybb.com/2019/06/10/mybb-1-8-21-released-security-maintenance-release/	Release Notes Vendor Advisory
https://blog.ripstech.com/2019/mybb-stored-xss-to-rce/	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*

History

21 Nov 2024, 04:23

Type	Values Removed	Values Added
References	~~() https://blog.mybb.com/2019/06/10/mybb-1-8-21-released-security-maintenance-release/ - Release Notes, Vendor Advisory~~	() https://blog.mybb.com/2019/06/10/mybb-1-8-21-released-security-maintenance-release/ - Release Notes, Vendor Advisory
References	~~() https://blog.ripstech.com/2019/mybb-stored-xss-to-rce/ - Exploit, Vendor Advisory~~	() https://blog.ripstech.com/2019/mybb-stored-xss-to-rce/ - Exploit, Vendor Advisory

Information

Published : 2019-06-15 18:29

Updated : 2024-11-21 04:23

NVD link : CVE-2019-12831

Mitre link : CVE-2019-12831

CVE.ORG link : CVE-2019-12831

JSON object : View

Products Affected

mybb

mybb

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2019-12831", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2019-06-15T18:29:00.283", "references": [{"url": "https://blog.mybb.com/2019/06/10/mybb-1-8-21-released-security-maintenance-release/", "tags": ["Release Notes", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://blog.ripstech.com/2019/mybb-stored-xss-to-rce/", "tags": ["Exploit", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://blog.mybb.com/2019/06/10/mybb-1-8-21-released-security-maintenance-release/", "tags": ["Release Notes", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://blog.ripstech.com/2019/mybb-stored-xss-to-rce/", "tags": ["Exploit", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "In MyBB before 1.8.21, an attacker can abuse a default behavior of MySQL on many systems (that leads to truncation of strings that are too long for a database column) to create a PHP shell in the cache directory of a targeted forum via a crafted XML import, as demonstrated by truncation of aaaaaaaaaaaaaaaaaaaaaaaaaa.php.css to aaaaaaaaaaaaaaaaaaaaaaaaaa.php with a 30-character limit, aka theme import stylesheet name RCE."}, {"lang": "es", "value": "En MyBB anterior a versi\u00f3n 1.8.21, un atacante puede abusar de un comportamiento por defecto de MySQL en muchos sistemas (lo que conlleva a un truncamiento de cadenas que muy largas para una columna de la base de datos) para crear un shell PHP en el directorio de cach\u00e9 de un foro apuntado por medio de un importaci\u00f3n XML creada, como es demostrado mediante el truncamiento de aaaaaaaaaaaaaaaaaaaaaaaa.php.css a aaaaaaaaaaaaaaaaaaaaaaaaaa.php con un l\u00edmite de 30 caracteres, tambi\u00e9n se conoce como Ejecuci\u00f3n de C\u00f3digo Remota (RCE) del nombre de la hoja de estilo (stylesheet name) theme import"}], "lastModified": "2024-11-21T04:23:40.667", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "438D60BF-E8A0-41F9-AE8E-B17569ECD586", "versionEndExcluding": "1.8.21"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}