PT-2006-5267 · Simple Machines · Simple Machines Forum

Thantos · Publicado 2006-08-31 · Atualizado 2018-10-17 · CVE-2006-4467

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Simple Machines Forum versions 1.0.x through 1.0.7 Simple Machines Forum versions 1.1RCx through 1.1RC2

Description The issue allows remote attackers to perform directory traversal attacks to read arbitrary local files, lock topics, and possibly have other security impacts. This is due to the software not properly unsetting variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value.

Recommendations For Simple Machines Forum versions 1.0.x through 1.0.7, update to version 1.0.8. For Simple Machines Forum versions 1.1RCx through 1.1RC2, update to version 1.1RC3.

Correção

Identificadores relacionados

CVE-2006-4467

Produtos afetados

Simple Machines Forum

Referências · 7

• http://retrogod.altervista.org/smf_11rc2_lock.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-4467 · Nota de Segurança
• http://retrogod.altervista.org/smf_11rc2_local_incl.html · Nota
• http://securityfocus.com/archive/1/444053/100/100/threaded · Nota
• http://securityreason.com/securityalert/1475 · Nota
• http://simplemachines.org/community/index.php?topic=107135.0 · Nota
• http://simplemachines.org/community/index.php?topic=107112.0 · Nota