PT-2007-5162 · Simple Machines · Simple Machines Forum

Published 2007-07-21 · Updated 2024-08-07 · CVE-2007-3942

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Simple Machines Forum (SMF) version 1.1.3

Description: A directory traversal issue in index.php allows remote attackers to include local files via unspecified vectors related to the sourcedir parameter or the actionArray hash. However, it is noted that both sourcedir and actionArray are defined before use, which is disputed by multiple third parties.

Recommendations: For Simple Machines Forum (SMF) version 1.1.3, consider restricting access to the index.php file until a patch is available. As a temporary workaround, avoid using the sourcedir parameter and the actionArray hash in the affected API endpoint. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2007-3942

Affected Products

Simple Machines Forum

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2007-3942 · Security Note
• http://securityfocus.com/archive/1/473866/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35451 · Note
• http://securityfocus.com/archive/1/480572/100/0/threaded · Note
• http://securityfocus.com/archive/1/473991/100/0/threaded · Note
• https://t.me/cvenotify/89685 · Telegram Post