Secunia Research has discovered a vulnerability in MyBB, which can be exploited by malicious people to compromise a vulnerable system. Input passed to the username field when registering is not properly sanitized before being used in a “preg_replace” call with the “e” modifier in the “domecode()” function in inc/functions_post.php. This can be exploited to execute arbitrary PHP code by first registering with a specially crafted username and then previewing a post containing the “/slap” string. The vulnerability has been confirmed in version 1.1.2. Prior versions may also be affected.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/47405/secunia-mybb.txt
Source: https://packetstormsecurity.com/files/47405/secunia-mybb.txt.html