PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

MyBB <= 1.8.31: Remote Code Execution Chain

swarm.ptsecurity.com | vulnerability | #rce | #sql-injection | #postgresql | #exploit-chain | #mybb
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A full exploit chain for MyBB <= 1.8.31: an SQL injection escalates to RCE when MyBB runs on PostgreSQL — pg_send_query allows stacked queries — with malicious templates executed by eval().
Published
Collected

Related coverage

vulnerability · theori.io
Chaining N-days to Compromise All: Part 6 — Windows Kernel LPE: Get SYSTEM
Final part of the N-day chain series: how CVE-2023-36802, a type-confusion flaw in the mskssrv.sys driver, was analysed and exploited to raise VMware privileges to SYSTEM on the host.
vulnerability · theori.io
Chaining N-days to Compromise All: Part 3 — Windows Driver LPE: Medium to System
Part three of the N-day exploit chain series, covering a Windows driver privilege-escalation flaw used to move from medium-integrity access to SYSTEM in a full exploit chain.
High · vulnerability · depthfirst.com
1-Click RCE To Steal Your OpenClaw Data and Keys (CVE-2026-25253)
A 1-click RCE chain against OpenClaw, the open-source AI assistant: a gatewayUrl settings flaw plus a WebSocket pivot turn one malicious page visit into token theft and command execution.
vulnerability · bishopfox.com
ColdFusion Bomb: A Chain Reaction From XSS to RCE
The technical companion to CVE-2015-0345: a DOM-based XSS in ColdFusion's admin panel chains into remote code execution by scheduling tasks and planting a CFML shell.
High · vulnerability · xbow.com
Cooking an SQL Injection Vulnerability in Chef Automate
Details an SQL injection in Chef Automate found via a little-known default data-collector token, letting authenticated attackers run arbitrary SQL against its PostgreSQL database.
Critical · vulnerability · yeswehack.com
CVE-2026-9082: PostgreSQL SQL Injection in Drupal
A patch analysis of CVE-2026-9082 (SA-CORE-2026-004): a PostgreSQL-specific SQL injection in Drupal’s entity query subsystem where unsanitised array keys reach SQL, plus PoC paths and the fix.
Back