PT-2011-2894 · Simple Machines · Simple Machines Forum

Steven M. Christey · Publicado 2011-06-21 · Atualizado 2012-12-20 · CVE-2011-1130

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Simple Machines Forum (SMF) versions prior to 1.1.13 Simple Machines Forum (SMF) versions 2.x prior to 2.0 RC5

Description The issue is related to improper validation of the start parameter, which could allow remote attackers to conduct SQL injection attacks, obtain sensitive information, or cause a denial of service via a crafted value. This is related to the cleanRequest function in QueryString.php and the constructPageIndex function in Subs.php.

Recommendations For Simple Machines Forum (SMF) versions prior to 1.1.13, update to version 1.1.13 or later. For Simple Machines Forum (SMF) versions 2.x prior to 2.0 RC5, update to version 2.0 RC5 or later.

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2011-1130

Produtos afetados

Simple Machines Forum

Referências · 6

• http://openwall.com/lists/oss-security/2011/03/02/4 · Correção
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1130 · Nota
• http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2011-1130 · Nota de Segurança
• http://openwall.com/lists/oss-security/2011/02/22/17 · Correção
• http://simplemachines.org/community/index.php?topic=421547.0 · Correção