PT-2024-38347 · Simple Machines · Simplemachines Smf

Fewwords · Published 2024-08-03 · Updated 2024-09-11 · CVE-2024-7437

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions SimpleMachines SMF version 2.1.4

Description A critical issue was found in the Delete User Handler component, specifically in the file /index.php?action=profile;u=2;area=showalerts;do=remove. The manipulation of the aid argument leads to improper control of resource identifiers, allowing for remote attacks. The exploit has been publicly disclosed and may be used, potentially resulting in unauthorized access and system compromise.

Recommendations For SimpleMachines SMF version 2.1.4, patch immediately to prevent exploitation. Additionally, monitor for exploit attempts to minimize the risk of unauthorized access and system compromise. As a temporary workaround, consider restricting access to the Delete User Handler component or disabling the manipulation of the aid argument until a patch is applied.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

CWE-99

Related Identifiers

CVE-2024-7437

Affected Products

Simplemachines Smf

References · 9

• 🔥 https://github.com/Fewword/Poc/blob/main/smf/smf-poc1.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-7437 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7437 · Security Note
• https://vuldb.com/?ctiid.273522 · Note
• https://t.me/cvenotify/94177 · Telegram Post
• https://t.me/cvedetector/2394 · Telegram Post
• https://vuldb.com/?submit.380189 · Note
• https://vuldb.com/?id.273522 · Note
• https://twitter.com/oktsec/status/1823498345882505529 · Twitter Post