> ## Content Index
> Fetch the complete content index at: https://darkwebinformer.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# CVE-2011-10018: myBB 1.6.4 Backdoor Arbitrary PHP Code Execution
- URL: https://darkwebinformer.com/cve-2011-10018-mybb-1-6-4-backdoor-arbitrary-php-code-execution/
- Published: 2025-08-14T15:36:53.000Z
- Updated: 2025-09-04T22:20:33.000Z
- Author: Dark Web Informer
- Tags: Vulnerabilities

**CVE ID:** CVE-2011-10018  
**CVSS v4:** 10.0 Critical  
**Publish Date:** August 13 2025  
**Last Updated:** August 14 2025

---

## TL;DR

myBB version 1.6.4 was released with an unauthorized backdoor embedded in the source code. This flaw allows remote, unauthenticated attackers to execute arbitrary PHP code via a specially crafted collapsed cookie, leading to full compromise of the web server in the context of the application.

---

## Affected Versions

- myBB 1.6.4 (only). The backdoor was introduced during packaging and was not part of the intended application logic.

---

## Vulnerability Details

- **Type:** Backdoor leading to arbitrary code injection (CWE 912, hidden functionality; CWE 94, code injection)
- **Description:** The malicious backdoor enables remote attackers to send a collapsed cookie that triggers arbitrary PHP code execution. No authentication is required, and exploitation results in full compromise of the web server.

---

## Recommended Action

1. **Immediate update** — if you are running myBB 1.6.4, upgrade to a clean, backdoor-free version such as 1.6.5 or later.
2. **Audit deployments** — confirm that your installation was not tampered with; compare packaged files to the official myBB repository.
3. **Incident response** — if you have used 1.6.4 in production, assume compromise, isolate the server, perform a forensic review, and rebuild from trusted sources.

---

## Affected Environments

- Any site running myBB 1.6.4, especially public-facing forums, is at high risk and should be prioritized for immediate remediation.

---

## TTP Mapping (MITRE ATT&CK)

- **Execution / Privilege Escalation:** Automatic code execution of attacker-supplied payload via HTTP (collapsed cookie), enabling unauthorized control of the application and host.

---

## References

- [NVD entry for CVE-2011-10018](https://nvd.nist.gov/vuln/detail/CVE-2011-10018)
- [CVEDetails summary](https://www.cvedetails.com/cve/CVE-2011-10018/)
- [GitHub Advisory: myBB 1.6.4 backdoor disclosure](https://github.com/advisories/GHSA-4whv-mhhp-7qcj)