7 stycznia 2008, by: 
kozik I have just found really beautiful security bug in MyBB – full PHP code injection… exploitable and (shit!) exploited already on some sites (love russian hackers 
)… With access to „system()” you have access to shell on webserver rights. Great…
Vendor had been notified with a proof of concept and a patch but… he sleeps and he will sleep till morning in Australia . The problem is they do not have a „security bug report site” or something similar – to post a security bug and to allow vendor fix it fast without unneeded attention. So everyone have to wait till sunshine in Australia .
8.01.2007, 14:04, update:
MyBB released version 1.2.11 which fixes this vulnerabilities (forumdisplay.php, search.php) and some other security bugs too.
17.01.2007, 14:51, update:
BTW on Milw0rm you can find some explanation and an exploit.
Styczeń 13th, 2008 at 21:50
No mimo wszystko – każdemu się może przydarzyć
W każdym razie – łatka wyszła dosyć szybko – dzięki Koziołek za czujność
Sierpień 13th, 2008 at 15:30
Ja się spóźniłem, tak czy siak dzięki za spostrzegawczość.