CVE-2011-10018

Katalog CVE

CVSS 9.8 · Critical EPSS 2,9%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada mybb. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

myBB version 1.6.4 was distributed with an unauthorized backdoor embedded in the source code. The backdoor allowed remote attackers to execute arbitrary PHP code by injecting payloads into a specially crafted collapsed cookie. This vulnerability was introduced during packaging and was not part of the intended application logic. Exploitation requires no authentication and results in full compromise of the web server under the context of the web application.

Rincian

Terbit di NVD

13 Agustus 2025

Terakhir diubah

16 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-912: Hidden Functionality

EPSS (30 hari)

2,9% peluang dieksploitasi; lebih tinggi dari 86,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://blog.mybb.com/2011/10/06/1-6-4-security-vulnerabilit/ advisory vendor
• https://web.archive.org/web/20111015224948/http://secunia.com/advisories/46300/ advisory pihak ketiga
• https://www.vulncheck.com/advisories/mybb-backdoor-arbitrary-command-execution advisory pihak ketiga
• https://www.exploit-db.com/exploits/17949 exploit
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/mybb_backdoo... product