CVE-2011-10018

The backdoor was introduced into the MyBB 1.6.4 distribution package during the packaging stage — it was not part of the original application logic. An attacker can execute arbitrary PHP code by injecting an appropriately prepared payload into a specially constructed cookie header named 'collapsed'. The exploit does not require authentication or any user interaction, and code execution occurs in the context of web application permissions on the server.

An attacker gains the ability to execute arbitrary PHP code on the server, resulting in complete takeover of the web server, including access to application data, database, and the possibility of further lateral movement in the infrastructure.

MyBB should be immediately updated to a version higher than 1.6.4 or patches indicated by the vendor in the official security notice (blog.mybb.com) should be applied. All installations based on version 1.6.4 should be treated as fully compromised and a server security audit should be conducted.

MyBB version 1.6.4 — only this version was distributed with the embedded backdoor