PT-2009-2127 · Simple Machines · Simple Machines Forum

Alessandro Tagliapietra · Publicado 2009-04-07 · Atualizado 2017-09-29 · CVE-2008-6657

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Simple Machines Forum (SMF) versions 1.0 through 1.0.14 Simple Machines Forum (SMF) versions 1.1 through 1.1.6

Description A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of admins for requests that install packages via the package parameter in an install2 action. This occurs due to insufficient validation of requests, enabling attackers to perform unauthorized actions.

Recommendations For Simple Machines Forum (SMF) versions 1.0 through 1.0.14, update to version 1.0.15 or later. For Simple Machines Forum (SMF) versions 1.1 through 1.1.6, update to version 1.1.7 or later.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2008-6657

Produtos afetados

Simple Machines Forum

Referências · 7

• 🔥 http://securityfocus.com/bid/32119 · Exploit
• 🔥 https://exploit-db.com/exploits/6993 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-6657 · Nota de Segurança
• http://simplemachines.org/community/index.php?topic=272861.0 · Aviso do Fabricante
• http://secunia.com/advisories/32516 · Aviso do Fabricante
• http://osvdb.org/50071 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46343 · Nota