[Cressi]

I was composing a PM just now, and typing the username; I got two users.

Searching the member list for "myBB", I found that there are loads of imported users just called "something_MyBB_import<year>".



I'm not sure if it's supposed to be like this, so just a heads up if it's not ^^

[Satan]

Those are from a merge and haven't had their names changed most likely.

[Nyx]

Probably bots or something inside of myBB itself. I wouldn't fuss over it too much though.

[Cressi]

Those are from a merge and haven't had their names changed most likely.

Yeah, that's my though as well.

Probably bots or something inside of myBB itself. I wouldn't fuss over it too much though.

Sounds fair enuogh, just wanted @Oni to know

[Eclipse]

Those are the lost souls. (That didn't merge properly) Get here @Oni

[Cressi]

Those are the lost souls (they didn't merge properly). Get here @Oni

Ah, that'd make lots of sense. Thanks ^^

[Oni]

Those are some of the people from the merge. I have to change the ending of their username to _HF still...

[Cressi]

Those are some of the people from the merge. I have to change the ending of their username to _HF still...

Oh, okay. Thanks for clearing that up ^^

[superMAUS]

Oh, okay. Thanks for clearing that up ^^

Wtf man? No 0days in this thread? Disgraceful.

How about a challenge. Find this 'vulnerability' and tell us how to exploit it (things with * have been censored out)

Code:

$upgrade = $mybb->input['upgrade_file']; require_once MYBB_ROOT."inc/plugins/******/upgrades/".$upgrade.".php";

EDIT: Worried my theory doesnt work :3
REDIT: Stupid me, would only verify file existence.