PT-2005-4858 · Simple Machines · Simple Machines Forum

Published 2005-12-11 · Updated 2024-08-08 · CVE-2005-4159

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Simple Machines Forum (SMF) versions 1.1 rc1 and earlier

Description A SQL injection issue in Memberlist.php allows remote attackers to potentially execute arbitrary SQL commands via the start parameter. However, the vendor and third parties dispute this, stating that since only one character can be modified, it does not constitute a SQL injection vulnerability, but rather an "invalid SQL syntax error."

Recommendations For Simple Machines Forum (SMF) versions 1.1 rc1 and earlier, as a temporary workaround, consider restricting access to the start parameter in the Memberlist.php file until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2005-4159

Affected Products

Simple Machines Forum

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2005-4159 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2005-12/0090.html · Note
• http://securityfocus.com/archive/1/419250/100/0/threaded · Note
• http://securityfocus.com/archive/1/419535/100/0/threaded · Note
• https://t.me/cvenotify/89847 · Telegram Post
• http://securityfocus.com/archive/1/419068/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23546 · Note
• http://securityfocus.com/bid/15791 · Note
• http://securityfocus.com/archive/1/419105/100/0/threaded · Note