{"vulnerability": "CVE-2022-24734", "sightings": [{"uuid": "ee2e81fc-a4e8-4f14-a61b-2b646de1574a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24734", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "b2b1ae9a-aa2f-4864-84d6-143f29471f0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24734", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:44.000000Z"}, {"uuid": "e894b007-84d8-49e5-9c3b-1f8433d1fd02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24734", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/mybb_rce_cve_2022_24734.rb", "content": "", "creation_timestamp": "2022-05-31T16:29:18.000000Z"}, {"uuid": "d5c4bfc4-8e00-45f1-9726-4f758431759c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24734", "type": "published-proof-of-concept", "source": "https://t.me/noobhackersyoutube/1936", "content": "MyBB 1.8.29 - Remote Code Execution (RCE) (Authenticated)\n\nhttps://github.com/Altelus1/CVE-2022-24734\n\n#MyBB #RCE #Auth_R", "creation_timestamp": "2022-05-12T07:49:07.000000Z"}, {"uuid": "f8c5d870-78c9-493e-ba79-7ff38c93190b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24734", "type": "published-proof-of-concept", "source": "https://t.me/poxek/1609", "content": "MyBB 1.8.29 - Remote Code Execution (RCE) (Authenticated)\nhttps://github.com/Altelus1/CVE-2022-24734\n\n\u0414\u043d\u0435\u0432\u043d\u0438\u043a \u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0438\u043a\u0430 \ud83d\udee1", "creation_timestamp": "2022-05-25T09:24:00.000000Z"}, {"uuid": "3d159384-fb1b-47b4-8b4a-c47cf2b16e70", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24734", "type": "published-proof-of-concept", "source": "https://t.me/MrVGunz/144", "content": "MyBB 1.8.29 - Remote Code Execution (RCE) (Authenticated)\n\nhttps://github.com/Altelus1/CVE-2022-24734", "creation_timestamp": "2022-05-11T21:15:25.000000Z"}, {"uuid": "d6ce87ea-3d4e-49cb-9b13-a979b8dd2125", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24734", "type": "published-proof-of-concept", "source": "Telegram/qeIlHXwk6VKV4UhXVPLQLbzvqENjIaoZ6ZELYqE5ad4Jd8Y", "content": "", "creation_timestamp": "2022-05-11T20:08:56.000000Z"}, {"uuid": "1f8b250e-34d1-4357-bb19-5c1c48a1fde1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24734", "type": "seen", "source": "https://t.me/cibsecurity/38631", "content": "\u203c CVE-2022-24734 \u203c\n\nMyBB is a free and open source forum software. In affected versions the Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type `php` with PHP code, executed on on _Change Settings_ pages. This results in a Remote Code Execution (RCE) vulnerability. The vulnerable module requires Admin CP access with the `Can manage settings?` permission. MyBB's Settings module, which allows administrators to add, edit, and delete non-default settings, stores setting data in an options code string ($options_code; mybb_settings.optionscode database column) that identifies the setting type and its options, separated by a new line character (\\n). In MyBB 1.2.0, support for setting type php was added, for which the remaining part of the options code is PHP code executed on Change Settings pages (reserved for plugins and internal use). MyBB 1.8.30 resolves this issue. There are no known workarounds.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-03-10T00:12:09.000000Z"}, {"uuid": "ffce0f9d-564b-4483-957d-f95795ee7097", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24734", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/5989", "content": "#exploit\n1. CVE-2022-24734:\nRCE in MyBB Admin CP\nhttps://github.com/Altelus1/CVE-2022-24734\n\n2. CVE-2022-26133:\nAtlassian Bitbucket Data Center - Java Deserialization Vulnerability in Hazelcast\nhttps://github.com/Pear1y/CVE-2022-26133", "creation_timestamp": "2022-05-12T11:01:01.000000Z"}, {"uuid": "b6e9e889-6f66-471e-8147-706da3250696", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24734", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/mybb_rce_cve_2022_24734.rb", "content": "{\"aliases\": [], \"arch\": \"php, cmd, x86, x64\", \"author\": [\"Cillian Collins\", \"Altelus\", \"Christophe De La Fuente\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This exploit module leverages an improper input validation\\n          vulnerability in MyBB prior to `1.8.30` to execute arbitrary code in\\n          the context of the user running the application.\\n\\n          MyBB Admin Control setting page calls PHP `eval` function with an\\n          unsanitized user input. The exploit adds a new setting, injecting the\\n          payload in the vulnerable field, and triggers its execution with a\\n          second request. Finally, it takes care of cleaning up and removes the\\n          setting.\\n\\n          Note that authentication is required for this exploit to work and the\\n          account must have rights to add or update settings (typically, myBB\\n          administrator role).\", \"disclosure_date\": \"2022-03-09\", \"fullname\": \"exploit/multi/http/mybb_rce_cve_2022_24734\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:57:58 +0000\", \"name\": \"MyBB Admin Control Code Injection RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"config-changes\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/mybb_rce_cve_2022_24734.rb\", \"platform\": \"Linux,PHP,Unix,Windows\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"multi/http/mybb_rce_cve_2022_24734\", \"references\": [\"GHSA-876v-gwgh-w57f\", \"URL-https://www.zerodayinitiative.com/advisories/ZDI-22-503/\", \"URL-https://github.com/Altelus1/CVE-2022-24734\", \"CVE-2022-24734\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"PHP\", \"Unix (In-Memory)\", \"Linux (Dropper)\", \"Windows (In-Memory)\", \"Windows (Dropper)\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:04.267611Z"}]}