PT-2009-2127 · Simple Machines · Simple Machines Forum

Alessandro Tagliapietra · Published 2009-04-07 · Updated 2017-09-29 · CVE-2008-6657

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Simple Machines Forum (SMF) versions 1.0 through 1.0.14 Simple Machines Forum (SMF) versions 1.1 through 1.1.6

Description A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of admins for requests that install packages via the package parameter in an install2 action. This occurs due to insufficient validation of requests, enabling attackers to perform unauthorized actions.

Recommendations For Simple Machines Forum (SMF) versions 1.0 through 1.0.14, update to version 1.0.15 or later. For Simple Machines Forum (SMF) versions 1.1 through 1.1.6, update to version 1.1.7 or later.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2008-6657

Affected Products

Simple Machines Forum

References · 7

• 🔥 http://securityfocus.com/bid/32119 · Exploit
• 🔥 https://exploit-db.com/exploits/6993 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-6657 · Security Note
• http://simplemachines.org/community/index.php?topic=272861.0 · Vendor Advisory
• http://secunia.com/advisories/32516 · Vendor Advisory
• http://osvdb.org/50071 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46343 · Note