CVE-2019-12831

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

In MyBB before 1.8.21, an attacker can abuse a default behavior of MySQL on many systems (that leads to truncation of strings that are too long for a database column) to create a PHP shell in the cache directory of a targeted forum via a crafted XML import, as demonstrated by truncation of aaaaaaaaaaaaaaaaaaaaaaaaaa.php.css to aaaaaaaaaaaaaaaaaaaaaaaaaa.php with a 30-character limit, aka theme import stylesheet name RCE.

Metrics

CVSS 3.0 7.2/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://blog.mybb.com/2019/06/10/mybb-1-8-21-released-security-maintenance-release/Release Notes, Vendor Advisory
https://blog.ripstech.com/2019/mybb-stored-xss-to-rce/Exploit, Vendor Advisory
https://blog.mybb.com/2019/06/10/mybb-1-8-21-released-security-maintenance-release/Release Notes, Vendor Advisory
https://blog.ripstech.com/2019/mybb-stored-xss-to-rce/Exploit, Vendor Advisory

Timeline

Published: Jun 15, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-128346.1In HT2 Labs Learning Locker 3.15.1, it's possible to inject malicious HTML and JavaScript code into the DOM of the website via the PATH_INFO CVE-2019-128359.8formats/xml.cpp in Leanify 0.4.3 allows for a controlled out-of-bounds write in xml_memory_writer::write via characters that require escapin CVE-2019-128368.8The Bobronix JEditor editor before 3.0.6 for Jira allows an attacker to add a URL/Link (to an existing issue) that can cause forgery of a re CVE-2019-128374.3The Java API in accesuniversitat.gencat.cat 1.7.5 allows remote attackers to get personal information of all registered students via several CVE-2019-128389.8SchedMD Slurm 17.11.x, 18.08.0 through 18.08.7, and 19.05.0 allows SQL Injection.CVE-2019-128398.8In OrangeHRM 4.3.1 and before, there is an input validation error within admin/listMailConfiguration (txtSendmailPath parameter) that allows CVE-2019-12847.8An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Elevation of Privilege Vulner CVE-2019-128408.8In Webmin through 1.910, any user authorized to the "Package Updates" module can execute arbitrary commands with root privileges via the dat CVE-2019-128417.5Incorrect handling of user input in ZIP extraction was detected in JetBrains TeamCity. The issue was fixed in TeamCity 2018.2.2.CVE-2019-128426.1A reflected XSS on a user page was detected on one of the JetBrains TeamCity pages. The issue was fixed in TeamCity 2018.2.2.CVE-2019-128436.1A possible stored JavaScript injection requiring a deliberate server administrator action was detected. The issue was fixed in JetBrains Tea CVE-2019-128446.1A possible stored JavaScript injection was detected on one of the JetBrains TeamCity pages. The issue was fixed in TeamCity 2018.2.3.