Code injection vulnerability

[Clumsy]

Mods care to explain 
https://community.mybb.com/global.php_SERVER

[Crazycat]

Can you explain the purpose of your post ?

[HLFadmin]

"File not found" is not the same as "404 Not Found"
Beyond that, I can't answer. But the suggestion is that there may be a vulnerability.

[Matt]

I also replied to your private inquiries thread, but again I'm not sure what the issue is here.

[Omar G.]

https://community.mybb.com/global.php?_SERVER

This is what you are looking at:
https://github.com/mybb/mybb/blob/e99ec5...hp#L12-L15

[codedude]

Nothing vulnerable here. Just mybb.com have a different nginx fastcgi_param value when .php file is not found which is different from any other .extension/directory

https://community.mybb.com/test.php - file not found
https://community.mybb.com/test.mybb - 404 Not Found
https://community.mybb.com/test - 404 Not Found

[noyle]

The unintended behaviors have been resolved. Thanks for the report and the explanation, Clumsy, HLFadmin and codedude.