PT-2011-2894 · Simple Machines · Simple Machines Forum

Steven M. Christey · Published 2011-06-21 · Updated 2012-12-20 · CVE-2011-1130

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Simple Machines Forum (SMF) versions prior to 1.1.13 Simple Machines Forum (SMF) versions 2.x prior to 2.0 RC5

Description The issue is related to improper validation of the start parameter, which could allow remote attackers to conduct SQL injection attacks, obtain sensitive information, or cause a denial of service via a crafted value. This is related to the cleanRequest function in QueryString.php and the constructPageIndex function in Subs.php.

Recommendations For Simple Machines Forum (SMF) versions prior to 1.1.13, update to version 1.1.13 or later. For Simple Machines Forum (SMF) versions 2.x prior to 2.0 RC5, update to version 2.0 RC5 or later.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2011-1130

Affected Products

Simple Machines Forum

References · 6

• http://openwall.com/lists/oss-security/2011/03/02/4 · Patch
• http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2011-1130 · Security Note
• http://openwall.com/lists/oss-security/2011/02/22/17 · Patch
• http://simplemachines.org/community/index.php?topic=421547.0 · Patch
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1130 · Note