关键信息 漏洞名称: Mail settings' command parameter injection 发布日期: Oct 4, 2022 CVE ID: CVE-2022-39265 严重程度: Moderate 受影响版本: < 1.8.31 修复版本: 1.8.31 影响 The Mail Settings → Additional Parameters for PHP's mail() (mail_parameters) setting value, in connection with the configured mail program's options and behavior, may allow access to sensitive information and Remote Code Execution (RCE). The vulnerable module requires Admin CP access with the Can manage settings? permission and may depend on configured file permissions. 修复 MyBB 1.8.31 addresses the issue by: Moving the source of the mail_parameters value to the Configuration File. Requiring existing write access to application files for parameter modification. Commit & Patch Commit: 0cd3181 Patch: https://github.com/mybb/mybb/commit/0cd318136a10b029bb5c8a8f6dddf39d87519797.patch 更多信息 Release Notes Security research 联系 安全团队联系方式: security@mybb.com