PT-2019-7017 · Simple Machines · Simple Machines Forum
Published
2019-03-07
·
Updated
2019-03-08
·
CVE-2013-7468
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Simple Machines Forum (SMF) version 2.0.4
Description
The issue allows PHP code injection through the
index.php?action=admin;area=languages;sa=editlang API endpoint, specifically via the dictionary parameter.Recommendations
For version 2.0.4, consider restricting access to the
index.php?action=admin;area=languages;sa=editlang endpoint until a patch is available, and avoid using the dictionary parameter in this endpoint to minimize the risk of exploitation.Exploit
Fix
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Simple Machines Forum