In MyBB before 1.8.11, the smilie module allows Directory Traversal via the pathfolder parameter.
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Link | Tags |
---|---|
http://seclists.org/fulldisclosure/2017/Apr/55 | mailing list exploit vdb entry third party advisory |
http://www.securityfocus.com/bid/98045 | vdb entry third party advisory |
https://blog.mybb.com/2017/04/04/mybb-1-8-11-merge-system-1-8-11-release/ | patch vendor advisory |