---
id: 5107
title: "MyBB <= 1.8.31: Remote Code Execution Chain"
source_domain: swarm.ptsecurity.com
source_url: "https://swarm.ptsecurity.com/mybb-1-8-31-remote-code-execution-chain/"
published_at: "2023-01-25T13:47:13Z"
tags: ["rce", "sql-injection", "postgresql", "exploit-chain", "mybb"]
phying_url: "https://phying.com/item/5107"
lang: en
---

# MyBB <= 1.8.31: Remote Code Execution Chain

## Summary

A full exploit chain for MyBB <= 1.8.31: an SQL injection escalates to RCE when MyBB runs on PostgreSQL — pg_send_query allows stacked queries — with malicious templates executed by eval().

## Intelligence Metadata

- **Sources:** swarm.ptsecurity.com
- **Published:** 2023-01-25T13:47:13Z
- **Original:** https://swarm.ptsecurity.com/mybb-1-8-31-remote-code-execution-chain/
- **Phying News:** https://phying.com/item/5107