PT-2008-6665 · Simpleforum · Simpleforum

Condemned · Published 2008-12-16 · Updated 2017-09-29 · CVE-2008-5604

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions My Simple Forum versions 3.0 through 4.1

Description The issue allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the action parameter in index.php when magic quotes gpc is disabled.

Recommendations For My Simple Forum versions 3.0 through 4.1, consider disabling the execution of files through the action parameter in index.php until a patch is available. Restrict access to the index.php file to minimize the risk of exploitation. Avoid using the action parameter with untrusted input. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-5604

Affected Products

Simpleforum

References · 7

• 🔥 https://exploit-db.com/exploits/7342 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-5604 · Security Note
• http://secunia.com/advisories/32984 · Vendor Advisory
• http://osvdb.org/50433 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47097 · Note
• http://securityfocus.com/bid/32643 · Note
• http://securityreason.com/securityalert/4765 · Note