CVE-2022-39265: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
value: MyBB is a free and open source forum software. The _Mail Settings_ ? Additional Parameters for PHP's mail() function mail_parameters setting value, in connection with the configured mail program's options and behavior, may allow access to sensitive information and Remote Code Execution (RCE). The vulnerable module requires Admin CP access with the `_Can manage settings?_` permission and may depend on configured file permissions. MyBB 1.8.31 resolves this issue with the commit `0cd318136a`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CVSS v3 base score: 7.2
Published: 2022-10-06T18:16Z
Repository: https://github.com/mybb/mybb
Language: PHP
Files changed: inc/functions.php, install/resources/settings.xml
Commit date: 2022-10-04 19:31:19 +0200
Commit message: Fix Mail settings command parameter injection

Diff: diff --git a/inc/functions.php b/inc/functions.php
index 075e53a55..14bb50fa3 100644
--- a/inc/functions.php
+++ b/inc/functions.php
@@ -579,13 +579,13 @@ function &get_my_mailhandler($use_buitlin = false)
 			// Using PHP mail().
 			else
 			{
 				require_once MYBB_ROOT . "inc/mailhandlers/php.php";
 				$my_mailhandler_builtin = new PhpMail();
-				if(!empty($mybb->settings['mail_parameters']))
+				if(!empty($mybb->config['mail_parameters']))
 				{
-					$my_mailhandler_builtin->additional_parameters = $mybb->settings['mail_parameters'];
+					$my_mailhandler_builtin->additional_parameters = $mybb->config['mail_parameters'];
 				}
 			}
 		}
 
 		$plugins->run_hooks('my_mailhandler_builtin_after_init', $my_mailhandler_builtin);
diff --git a/install/resources/settings.xml b/install/resources/settings.xml
index 4a840e403..6a3c1bd39 100644
--- a/install/resources/settings.xml
+++ b/install/resources/settings.xml
@@ -2328,11 +2328,11 @@ smtp=SMTP mail]]></optionscode>
 			<settingvalue><![CDATA[0]]></settingvalue>
 			<isdefault>1</isdefault>
 		</setting>
 		<setting name="mail_parameters">
 			<title>Additional Parameters for PHP's mail()</title>
-			<description><![CDATA[This setting allows you to set additional parameters for the PHP mail() function. Only used when 'PHP mail' is selected as Mail Handler. <a href="http://php.net/function.mail" target="_blank" rel="noopener">More information</a>]]></description>
+			<description><![CDATA[<strong>Not supported.</strong> Additional parameters can be set in the <a href="https://docs.mybb.com/1.8/faq/mail/#additional-parameters-for-phps-mail">Configuration File</a> instead.]]></description>
 			<disporder>7</disporder>
 			<optionscode><![CDATA[text]]></optionscode>
 			<settingvalue><![CDATA[]]></settingvalue>
 			<isdefault>1</isdefault>
 		</setting>

Vulnerable code: 				if(!empty($mybb->settings['mail_parameters']))
					$my_mailhandler_builtin->additional_parameters = $mybb->settings['mail_parameters'];
			<description><![CDATA[This setting allows you to set additional parameters for the PHP mail() function. Only used when 'PHP mail' is selected as Mail Handler. <a href="http://php.net/function.mail" target="_blank" rel="noopener">More information</a>]]></description>
Fixed code: 				if(!empty($mybb->config['mail_parameters']))
					$my_mailhandler_builtin->additional_parameters = $mybb->config['mail_parameters'];
			<description><![CDATA[<strong>Not supported.</strong> Additional parameters can be set in the <a href="https://docs.mybb.com/1.8/faq/mail/#additional-parameters-for-phps-mail">Configuration File</a> instead.]]></description>