PT-2005-4858 · Simple Machines · Simple Machines Forum

CVE-2005-4159 · Publicado 2005-12-11 · Atualizado 2024-08-08

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Simple Machines Forum (SMF) versions 1.1 rc1 and earlier

Description A SQL injection issue in Memberlist.php allows remote attackers to potentially execute arbitrary SQL commands via the start parameter. However, the vendor and third parties dispute this, stating that since only one character can be modified, it does not constitute a SQL injection vulnerability, but rather an "invalid SQL syntax error."

Recommendations For Simple Machines Forum (SMF) versions 1.1 rc1 and earlier, as a temporary workaround, consider restricting access to the start parameter in the Memberlist.php file until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2005-4159

Produtos afetados

Simple Machines Forum

Referências · 9

• http://archives.neohapsis.com/archives/bugtraq/2005-12/0090.html · Nota
• http://securityfocus.com/archive/1/419250/100/0/threaded · Nota
• http://securityfocus.com/archive/1/419535/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-4159 · Nota de Segurança
• https://t.me/cvenotify/89847 · Publicação no Telegram
• http://securityfocus.com/archive/1/419068/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23546 · Nota
• http://securityfocus.com/bid/15791 · Nota
• http://securityfocus.com/archive/1/419105/100/0/threaded · Nota