PT-2009-2014 · Simple Machines · Simple Machines Forum

CVE-2008-6544 · Publicado 2009-03-30 · Atualizado 2024-08-07

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Simple Machines Forum (SMF) version 1.1.4

Description The issue allows remote attackers to potentially execute arbitrary PHP code. This is achieved via a URL in the settings[default theme dir] parameter to "Sources/Subs-Graphics.php" and "Sources/Themes.php" API endpoints. However, it's noted that the files contain a protection mechanism against direct requests, which has led to disputes about the issue from multiple third parties.

Recommendations For Simple Machines Forum (SMF) version 1.1.4, consider restricting access to the settings[default theme dir] parameter in the affected API endpoints as a temporary workaround until a patch is available. Avoid using the settings[default theme dir] parameter in the "Sources/Subs-Graphics.php" and "Sources/Themes.php" endpoints to minimize the risk of exploitation.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2008-6544

Produtos afetados

Simple Machines Forum

Referências · 8

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2008-03/0425.html · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2008-03/0431.html · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2008-03/0426.html · Exploit
• 🔥 https://exploit-db.com/exploits/31555 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-6544 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41518 · Nota
• http://securityfocus.com/bid/28493 · Nota
• http://osvdb.org/51301 · Nota