CVE-2025-29460

Executive Summary

CVE-2025-29460 targets MyBB 1.8.38, a widely used open-source forum software. The vulnerability allows a remote attacker to obtain sensitive information via the "Add Mycode" function. The vendor disputes the finding, arguing that the actions are limited to Board administrators and that SSRF mitigations are in place. However, from a threat intelligence perspective, any information disclosure by an authenticated administrator can be leveraged in a post-exploitation scenario or by a compromised admin account. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the lack of a patch makes this a latent risk for all MyBB 1.8.38 installations.

Supply Chain & Package Security

MyBB is a PHP-based application distributed as a ZIP archive from mybb.com. There is no NPM, PyPI, Go, or Ruby package involved. The supply chain risk is limited to the integrity of the official download source and any third-party plugins or themes that may be installed.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is unusual. This likely indicates that the NVD has not yet assigned a proper score due to the vendor dispute. Based on the description, a reasonable assessment would be:

• Attack Vector (AV): Network (the function is accessible via HTTP)
• Attack Complexity (AC): Low (no special conditions)
• Privileges Required (PR): High (requires admin login)
• User Interaction (UI): None
• Scope (S): Unchanged
• Confidentiality (C): High (sensitive info disclosure)
• Integrity (I): None
• Availability (A): None

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Estimated Score: 4.9 (Medium)

The threat level is Medium due to the requirement for admin privileges, but the potential for sensitive data leakage (e.g., database credentials, file paths) makes it a significant concern for post-exploitation.

Deep Dive & Mechanics

The vulnerability resides in the "Add Mycode" functionality, which allows administrators to define custom MyCode (BBCode-like) tags. The issue is that the function does not properly sanitize or restrict the input, leading to information disclosure.

Root Cause:
The admin/modules/config/mycode.php file (or similar) processes the "Add Mycode" form. When an admin submits a new MyCode definition, the application may reflect or store user-supplied data in a way that exposes internal server information. For example, if the "replacement" field is not sanitized, an attacker could inject PHP code or file paths that are then displayed in error messages or logs.

Attack Vector:

1. An attacker gains admin credentials (via phishing, brute force, or session hijacking).
2. The attacker navigates to the "Add Mycode" page.
3. The attacker inputs a malicious payload in one of the fields (e.g., {PHP} or {INCLUDE}).
4. The application processes the input and returns sensitive information (e.g., server file paths, database credentials from error messages).

Why the Vendor Disputes:
The vendor argues that only Board administrators can access this function, and that SSRF mitigations are in place. However, this ignores the risk of compromised admin accounts. Additionally, SSRF mitigation does not prevent information disclosure via error messages or reflected output.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code path.

Vulnerable Code (MyBB 1.8.38 - admin/modules/config/mycode.php):

// Vulnerable: No sanitization of $mycode['replacement']
$new_mycode = array(
    "title" => $db->escape_string($mycode['title']),
    "description" => $db->escape_string($mycode['description']),
    "replacement" => $mycode['replacement'], // Directly used
    // ...
);

Patched Code (Hypothetical):

// Patched: Sanitize and validate the replacement field
$new_mycode = array(
    "title" => $db->escape_string($mycode['title']),
    "description" => $db->escape_string($mycode['description']),
    "replacement" => htmlspecialchars($mycode['replacement'], ENT_QUOTES, 'UTF-8'),
    // ...
);

The patched version would use htmlspecialchars() to prevent any HTML or PHP code from being executed or reflected.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install MyBB 1.8.38 on a local server (e.g., XAMPP or Docker).
2. Create an admin account.
3. Log in as admin.

Exploitation Steps:

1. Navigate to Admin CP > Configuration > MyCode.
2. Click "Add New MyCode".
3. In the "Replacement" field, enter a payload to trigger information disclosure:

   {PHP} echo file_get_contents('/etc/passwd'); {/PHP}
   

   Or, to trigger an error that reveals the path:

   {INCLUDE}nonexistent_file.php{/INCLUDE}
   

4. Save the MyCode.
5. The application may display an error message containing the server path or execute the PHP code, revealing sensitive data.

Expected Output:

Warning: include(nonexistent_file.php): failed to open stream: No such file or directory in /var/www/html/mybb/admin/modules/config/mycode.php on line 123

Blue Team

Detection:

• Monitor admin panel access logs for unusual MyCode creation.
• Look for payloads containing {PHP}, {INCLUDE}, or file paths in the replacement field.
• Use WAF rules to block common PHP code injection patterns.

Mitigation:

• Restrict admin access to trusted IPs.
• Enable two-factor authentication (2FA) for admin accounts.
• Apply input validation and output encoding to all admin functions.

Indicators of Compromise (IOCs)

• File Paths: /var/www/html/mybb/admin/modules/config/mycode.php
• Log Entries: "Add Mycode" action with suspicious payloads.
• Network Traffic: POST requests to /admin/index.php?module=config-mycode&action=add with unusual replacement field values.
• Error Messages: PHP warnings containing server file paths.

Detection Engineering

YARA Rule

rule CVE_2025_29460_MyBB_InfoDisclosure {
    meta:
        description = "Detects attempts to exploit CVE-2025-29460 in MyBB 1.8.38"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-29460"
    strings:
        $payload1 = "{PHP}" ascii wide nocase
        $payload2 = "{INCLUDE}" ascii wide nocase
        $payload3 = "file_get_contents" ascii wide nocase
        $admin_path = "admin/modules/config/mycode.php" ascii wide nocase
    condition:
        any of ($payload*) and $admin_path
}

Sigma Rule

title: MyBB CVE-2025-29460 Information Disclosure Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects POST requests to MyBB admin MyCode creation with suspicious payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "module=config-mycode&action=add"
        cs-request-body|contains:
            - "{PHP}"
            - "{INCLUDE}"
            - "file_get_contents"
    condition: selection
falsepositives:
    - Legitimate admin usage of MyCode with PHP tags (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-29460 MyBB Information Disclosure Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"module=config-mycode&action=add";
    http_uri;
    content:"{PHP}";
    http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2025-29460;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the "Add Mycode" function for non-essential admins by modifying the admin permissions.
2. Apply input validation to the replacement field in admin/modules/config/mycode.php:

   $mycode['replacement'] = htmlspecialchars($mycode['replacement'], ENT_QUOTES, 'UTF-8');
   

3. Monitor admin logs for any unusual MyCode creation activity.

Long-Term Fix:

• Await an official patch from MyBB. In the meantime, consider upgrading to a newer version if available, or apply the manual code fix above.
• Implement a Web Application Firewall (WAF) to block common injection patterns.

Workaround:

• Restrict admin access to trusted IP addresses only.
• Enable 2FA for all admin accounts.

Valters IT