The installer in MyBB before 1.8.13 allows remote attackers to execute arbitrary code by writing to the configuration file.Referenceshttps://blog.mybb.com/2017/11/07/mybb-1-8-13-released-security-maintenance-release/https://www.exploit-db.com/exploits/43136/
