MyBB Installer PHP Code Injection Vulnerability

MyBB, free and open source forum software, is affected by a PHP code injection vulnerability in its installer module. From 1.8.13 until 1.8.40, the installer does not properly escape user-supplied database configuration values written to the configuration file, resulting in remote code execution when the installer is available.

install/index.php processes the values with addcslashes(), but the $characters argument added in MyBB 1.8.13 does not include the backslash character, allowing crafted input to escape the generated PHP string. The issue was introduced in MyBB 1.8.13.

• Affected versions: MyBB 1.8.13 through 1.8.39
• Fixed in: MyBB 1.8.40