MyBB 1.8.32 Authenticated Remote Code Execution via Chained Vulnerabilities
No sign of exploitation. No public exploitation artifact known so far.
MyBB 1.8.32 allows logged-in administrators to upload malicious files by bypassing upload restrictions and then execute harmful code on the server. This happens because the software doesn't properly validate file uploads and allows editing of settings that control where files are stored.
An authenticated administrator can chain multiple vulnerabilities to achieve RCE: modify upload directory settings via configuration, upload a PHP-embedded image file that bypasses avatar upload validation (CWE-22 path traversal), and execute arbitrary code through the language configuration interface. Requires admin-level privileges but achieves complete code execution on the target system.