[phyrrus9]

Yeah, the MyBB ACP has a ton of vulnerabilities, and the coders are too lazy to fix them.

Oni, shouldn't it still display in the logs which user accessed the ACP to plant the shell? It could give us a clue to whether any staff/admin accounts were compromised. if no user is shown, then it is possible there is a 0day outside of the ACP that allowed the attacker to gain access to it and plant the shell using a second vulnerability in the ACP itself.

Also, if you guys think there is a unpublished vulnerability, let me know so I can dig through the MyBB source and try and find it.

Anyways, I hope to be more active on Sinisterly. Oni runs a great forum.

Only one account had access to that, it is likely somebody just found a way in without logging in correctly.