CyberRota Analysis
AI-GeneratedMyBB forum software versions prior to 1.8.40 are vulnerable to a server-side request forgery (SSRF) due to improper handling of IPv6 addresses in the remote requests feature. This flaw allows attackers to bypass host restrictions, potentially leading to unauthorized access to internal resources. Organizations using affected versions should prioritize upgrading to 1.8.40 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
MyBB is free and open source forum software. Prior to 1.8.40, the remote requests feature does not correctly handle IPv6 addresses, resulting in a server-side request forgery vulnerability. The default disallowed remote hosts list does not include IPv6 addresses. Verification in fetch_remote_file() fails open when get_ip_by_hostname() returns no result because that function does not return IPv6 results, allowing a crafted remote target to bypass the host restriction. The uniquely identifying implementation details include fail-open verification, and inc/functions.php. This issue is fixed in version 1.8.40.