217 - Insecure Firewalls, MyBB, and Winning with WinRAR

This week we've got some fun issues, including a WinRAR processing bug that results in code execution due (imo) to a filename adjustment when extracting that isn't performed consistently. A MyBB admin-panel RCE, fairly privileged bug but I think the bug pattern could appear elsewhere and is something to watch out for, And several silly issues in a "next-gen" firewall, including source disclosures and RCEs from the login page.

admin admin-panel bounty-podcast bug code code execution filename firewalls fun imo insecure isn mybb panel podcast privileged rce results watch week winning winrar