Local File Inclusion and reading password-protected forums in MyBB

Recently, I've been looking at the MyBB forum software to try to find security issues with it. Here are the results that I have so far. These have been reported privately to the maintainers of the software. The first two are fixed in version 1.8.15, and the third will be fixed in 1.8.16.

1. Local File Inclusion in admin panel.

From the admin panel, select:
Tools and Maintenance -> Task Manager -> Add New Task

Then, when submitting the request, modify the "file" POST parameter as shown below, and the file "../../../file.php" will be executed when the task is run (if the file exists).

2. Read posts in password-protected forums

A feature of MyBB is the ability to create password-protected forums. If a forum is password-protected, then only users who know the password will be able to view the posts in that forum.

However, MyBB does not require a password for users to subscribe to a password-protected forum (or the threads inside it). Furthermore, when users subscribe to a forum, they can get a notification by email or private message every time a user posts. This notification contains an excerpt of the message which was posted in the private forum.

To use, simply access the below URL while logged in as an ordinary user, then follow the prompts:
http://<target website>/usercp2.php?action=addsubscription&type=forum&fid=<forum id>&my_post_key=<your post key>

3. Forum passwords stored in plaintext

Unlike the passwords for users in MyBB (which are hashed), the passwords for password-protected forums are stored in plaintext. Although this is not directly exploitable, if someone gains access the database, they will be able to read the passwords.


  1. I really loved reading your blog. It was very well authored and easy to understand. Unlike other blogs I have read which are really not that good.Thanks alot
    jogos friv gratis
    Jogos online
    jogos 4 school

  2. Planning a wedding that takes place under one roof, offers so many advantages. In the first instance a venue that offers a wedding package, tend to employ people who are experts in this field. They plan weddings for a living. They are the experts. Whilst many venues only offer the room and catering, a wedding under one roof many include a wedding planner and if they don't they will be working regularly with florists, cake makers, companies that do decorations, DJ's and photographers.
    Jogo para menino
    360 jogos 2019
    game io 2019

  3. The cultural history of Inter-war Europe is filled with such powerful and influential interpretations of a reality that defeats the human capacity to imagine evil. Take Picasso's Guernica for instance. In June 1937, Picasso finished painting the Modernist classic in response to another April tragedy: the bombing of the Spanish city of Guernica during the civil war. It was his anguished creativity reacting to George Steer's eyewitness account of the incident.
    kizi kizi 2 games
    free games
    friv Games for kids 2019

  4. Looking for best English to Tamil Translation tool online, make use of our site to enjoy Tamil typing and directly share on your social media handle. mallika manivannan novels

  5. Thanks for sharing an informative blog keep rocking bring more details.I like the helpful info you provide in your articles. I’ll bookmark your weblog and check again here regularly. I am quite sure I will learn much new stuff right here! Good luck for the next!
    mobile application development training online
    mobile app development course
    mobile application development training
    mobile app development course online
    mobile application development course
    online mobile application development
    learn mobile application development

  6. Aluminium Composite Panel or ACP Sheet is used for building exteriors, interior applications, and signage. They are durable, easy to maintain & cost-effective with different colour variants.

  7. Soma pill is very effective as a painkiller that helps us to get effective relief from pain. This cannot cure pain. Yet when it is taken with proper rest, it can offer you effective relief from pain.
    This painkiller can offer you relief from any kind of pain. But Soma 350 mg is best in treating acute pain. Acute pain is a type of short-term pain which is sharp in nature. Buy Soma 350 mg online to get relief from your acute pain.


    Buy Soma 350 mg
    Soma Pill
    Buy Soma 350 mg online

    Buy Soma 350 mg online
    Soma Pill
    Buy Soma 350 mg

  8. I want to learn but I am far behind the skill level to even able take one class of it in college. Iam a 19 year old that wants to learn it.
    ExcelR Digital Marketing Courses In Bangalore

  9. Thanks a lot for sharing such a good source with all, i appreciate your efforts taken for the same. I found this worth sharing and must share this with all.

    Dot Net Training in Chennai | Dot Net Training in anna nagar | Dot Net Training in omr | Dot Net Training in porur | Dot Net Training in tambaram | Dot Net Training in velachery

  10. Such a very useful article. Very interesting to read this article. I would like to thank you for the efforts you had made for writing this awesome article.
    Data Science Course in Pune
    Data Science Training in Pune

  11. I feel very grateful that I read this. It is very helpful and very informative and I really learned a lot from it.
    Data Analytics Course in Pune
    Data Analytics Training in Pune

  12. I am impressed by the information that you have on this blog. It shows how well you understand this subject.
    Business Analytics Course in Pune
    Business Analytics Training in Pune

  13. This is additionally a generally excellent post which I truly delighted in perusing. It isn't each day that I have the likelihood to see something like this.. data science course in chennai

  14. Nice Blog!! Thanks For Sharing!!!Wonderful blog & good post. Its really helpful for me, waiting for a more new post. Keep Blogging!
    Servicenow Training In Hyderabad


Post a Comment

Popular posts from this blog

Security implications of ANSI escape codes in Git sever responses

Experimenting with the Audiocodes MP264