Vulnerabilites related to simplemachines - smf
CVE-2011-1128 (GCVE-0-2011-1128)
Vulnerability from cvelistv5
Published
2011-06-21 01:00
Modified
2024-09-16 22:16
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
The loadUserSettings function in Load.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, does not properly handle invalid login attempts, which might make it easier for remote attackers to obtain access or cause a denial of service via a brute-force attack.
References
| ► | URL | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T22:14:27.771Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20110222 CVE request: simple machines forum before 1.1.13",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2011/02/22/17"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.simplemachines.org/community/index.php?topic=421547.0"
},
{
"name": "[oss-security] 20110302 Re: CVE request: simple machines forum before 1.1.13",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2011/03/02/4"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The loadUserSettings function in Load.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, does not properly handle invalid login attempts, which might make it easier for remote attackers to obtain access or cause a denial of service via a brute-force attack."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2011-06-21T01:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[oss-security] 20110222 CVE request: simple machines forum before 1.1.13",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2011/02/22/17"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.simplemachines.org/community/index.php?topic=421547.0"
},
{
"name": "[oss-security] 20110302 Re: CVE request: simple machines forum before 1.1.13",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2011/03/02/4"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2011-1128",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The loadUserSettings function in Load.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, does not properly handle invalid login attempts, which might make it easier for remote attackers to obtain access or cause a denial of service via a brute-force attack."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[oss-security] 20110222 CVE request: simple machines forum before 1.1.13",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2011/02/22/17"
},
{
"name": "http://www.simplemachines.org/community/index.php?topic=421547.0",
"refsource": "CONFIRM",
"url": "http://www.simplemachines.org/community/index.php?topic=421547.0"
},
{
"name": "[oss-security] 20110302 Re: CVE request: simple machines forum before 1.1.13",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2011/03/02/4"
},
{
"name": "http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip",
"refsource": "CONFIRM",
"url": "http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2011-1128",
"datePublished": "2011-06-21T01:00:00Z",
"dateReserved": "2011-03-02T00:00:00Z",
"dateUpdated": "2024-09-16T22:16:08.641Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-7437 (GCVE-0-2024-7437)
Vulnerability from cvelistv5
Published
2024-08-03 14:31
Modified
2024-08-10 06:26
Severity ?
5.3 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
5.4 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
5.4 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
VLAI Severity ?
EPSS score ?
CWE
- CWE-99 - Improper Control of Resource Identifiers
Summary
A vulnerability, which was classified as critical, was found in SimpleMachines SMF 2.1.4. Affected is an unknown function of the file /index.php?action=profile;u=2;area=showalerts;do=remove of the component Delete User Handler. The manipulation of the argument aid leads to improper control of resource identifiers. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
References
| ► | URL | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| SimpleMachines | SMF |
Version: 2.1.4 |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:simplemachines:simple_machine_forum:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "simple_machine_forum",
"vendor": "simplemachines",
"versions": [
{
"status": "affected",
"version": "2.1.4"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-7437",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-06T14:21:49.377339Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-06T14:24:08.526Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Delete User Handler"
],
"product": "SMF",
"vendor": "SimpleMachines",
"versions": [
{
"status": "affected",
"version": "2.1.4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Fewwords (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability, which was classified as critical, was found in SimpleMachines SMF 2.1.4. Affected is an unknown function of the file /index.php?action=profile;u=2;area=showalerts;do=remove of the component Delete User Handler. The manipulation of the argument aid leads to improper control of resource identifiers. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used."
},
{
"lang": "de",
"value": "Es wurde eine Schwachstelle in SimpleMachines SMF 2.1.4 gefunden. Sie wurde als kritisch eingestuft. Es geht dabei um eine nicht klar definierte Funktion der Datei /index.php?action=profile;u=2;area=showalerts;do=remove der Komponente Delete User Handler. Durch das Manipulieren des Arguments aid mit unbekannten Daten kann eine improper control of resource identifiers-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.5,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-99",
"description": "CWE-99 Improper Control of Resource Identifiers",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-10T06:26:10.103Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-273522 | SimpleMachines SMF Delete User index.php resource injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.273522"
},
{
"name": "VDB-273522 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.273522"
},
{
"name": "Submit #380189 | SimpleMachines SMF 2.1.4 Insecure Direct Object Reference",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.380189"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/Fewword/Poc/blob/main/smf/smf-poc1.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-08-02T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2024-08-02T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2024-08-10T08:31:03.000Z",
"value": "VulDB entry last update"
}
],
"title": "SimpleMachines SMF Delete User index.php resource injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2024-7437",
"datePublished": "2024-08-03T14:31:04.930Z",
"dateReserved": "2024-08-02T21:22:25.233Z",
"dateUpdated": "2024-08-10T06:26:10.103Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-2582 (GCVE-0-2025-2582)
Vulnerability from cvelistv5
Published
2025-03-21 06:31
Modified
2025-04-21 12:41
Severity ?
5.1 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
3.5 (Low) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
3.5 (Low) - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
3.5 (Low) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
3.5 (Low) - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
VLAI Severity ?
EPSS score ?
Summary
A vulnerability was found in SimpleMachines SMF 2.1.4 and classified as problematic. Affected by this issue is some unknown functionality of the file ManageAttachments.php. The manipulation of the argument Notice leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor does not declare this issue a security vulnerability due to authentication requirements before being able to access any feature in the software that allows file modification.
References
| ► | URL | Tags | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| SimpleMachines | SMF |
Version: 2.1.4 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-2582",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-21T13:56:58.651390Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-21T13:57:15.731Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "SMF",
"vendor": "SimpleMachines",
"versions": [
{
"status": "affected",
"version": "2.1.4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Fewwords (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in SimpleMachines SMF 2.1.4 and classified as problematic. Affected by this issue is some unknown functionality of the file ManageAttachments.php. The manipulation of the argument Notice leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor does not declare this issue a security vulnerability due to authentication requirements before being able to access any feature in the software that allows file modification."
},
{
"lang": "de",
"value": "Eine Schwachstelle wurde in SimpleMachines SMF 2.1.4 gefunden. Sie wurde als problematisch eingestuft. Dies betrifft einen unbekannten Teil der Datei ManageAttachments.php. Dank der Manipulation des Arguments Notice mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung. Bisher konnte die Existenz der vermeintlichen Schwachstelle noch nicht eindeutig nachgewiesen werden."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-21T12:41:42.523Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-300542 | SimpleMachines SMF ManageAttachments.php cross site scripting",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.300542"
},
{
"name": "VDB-300542 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.300542"
},
{
"name": "Submit #511999 | SimpleMachines SMF 2.1.4 Cross Site Scripting",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.511999"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/Fewword/Poc/blob/main/smf/smf-poc3.md"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/Fewword/Poc/blob/main/smf/smf-poc4.md"
}
],
"tags": [
"disputed"
],
"timeline": [
{
"lang": "en",
"time": "2025-03-20T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-03-20T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-04-21T14:46:35.000Z",
"value": "VulDB entry last update"
}
],
"title": "SimpleMachines SMF ManageAttachments.php cross site scripting"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-2582",
"datePublished": "2025-03-21T06:31:04.195Z",
"dateReserved": "2025-03-20T22:59:14.375Z",
"dateUpdated": "2025-04-21T12:41:42.523Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2011-1131 (GCVE-0-2011-1131)
Vulnerability from cvelistv5
Published
2011-06-21 01:00
Modified
2024-09-16 16:23
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
The PlushSearch2 function in Search.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, uses certain cached data in a situation where a temporary table has been created, even though this cached data is intended only for situations where a temporary table has not been created, which might allow remote attackers to obtain sensitive information via a search.
References
| ► | URL | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T22:14:27.824Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20110222 CVE request: simple machines forum before 1.1.13",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2011/02/22/17"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.simplemachines.org/community/index.php?topic=421547.0"
},
{
"name": "[oss-security] 20110302 Re: CVE request: simple machines forum before 1.1.13",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2011/03/02/4"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The PlushSearch2 function in Search.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, uses certain cached data in a situation where a temporary table has been created, even though this cached data is intended only for situations where a temporary table has not been created, which might allow remote attackers to obtain sensitive information via a search."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2011-06-21T01:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[oss-security] 20110222 CVE request: simple machines forum before 1.1.13",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2011/02/22/17"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.simplemachines.org/community/index.php?topic=421547.0"
},
{
"name": "[oss-security] 20110302 Re: CVE request: simple machines forum before 1.1.13",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2011/03/02/4"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2011-1131",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The PlushSearch2 function in Search.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, uses certain cached data in a situation where a temporary table has been created, even though this cached data is intended only for situations where a temporary table has not been created, which might allow remote attackers to obtain sensitive information via a search."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[oss-security] 20110222 CVE request: simple machines forum before 1.1.13",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2011/02/22/17"
},
{
"name": "http://www.simplemachines.org/community/index.php?topic=421547.0",
"refsource": "CONFIRM",
"url": "http://www.simplemachines.org/community/index.php?topic=421547.0"
},
{
"name": "[oss-security] 20110302 Re: CVE request: simple machines forum before 1.1.13",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2011/03/02/4"
},
{
"name": "http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip",
"refsource": "CONFIRM",
"url": "http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2011-1131",
"datePublished": "2011-06-21T01:00:00Z",
"dateReserved": "2011-03-02T00:00:00Z",
"dateUpdated": "2024-09-16T16:23:54.287Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2011-3615 (GCVE-0-2011-3615)
Vulnerability from cvelistv5
Published
2011-10-24 17:00
Modified
2024-08-06 23:37
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Multiple SQL injection vulnerabilities in Simple Machines Forum (SMF) before 1.1.15 and 2.x before 2.0.1 allow remote attackers to execute arbitrary SQL commands via vectors involving a (1) HTML entity or (2) display name. NOTE: some of these details are obtained from third party information.
References
| ► | URL | Tags | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T23:37:48.639Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "simplemachines-spoofing-unspecified(70617)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/70617"
},
{
"name": "46386",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/46386"
},
{
"name": "[oss-security] 20111010 Re: CVE request: simple machines forum before 2.0.1 and 1.1.15",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://openwall.com/lists/oss-security/2011/10/10/6"
},
{
"name": "[oss-security] 20111009 CVE request: simple machines forum before 2.0.1 and 1.1.15",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://openwall.com/lists/oss-security/2011/10/09/3"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.simplemachines.org/community/index.php?topic=452888.0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-09-18T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple SQL injection vulnerabilities in Simple Machines Forum (SMF) before 1.1.15 and 2.x before 2.0.1 allow remote attackers to execute arbitrary SQL commands via vectors involving a (1) HTML entity or (2) display name. NOTE: some of these details are obtained from third party information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-28T12:57:01",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "simplemachines-spoofing-unspecified(70617)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/70617"
},
{
"name": "46386",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/46386"
},
{
"name": "[oss-security] 20111010 Re: CVE request: simple machines forum before 2.0.1 and 1.1.15",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://openwall.com/lists/oss-security/2011/10/10/6"
},
{
"name": "[oss-security] 20111009 CVE request: simple machines forum before 2.0.1 and 1.1.15",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://openwall.com/lists/oss-security/2011/10/09/3"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.simplemachines.org/community/index.php?topic=452888.0"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2011-3615",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple SQL injection vulnerabilities in Simple Machines Forum (SMF) before 1.1.15 and 2.x before 2.0.1 allow remote attackers to execute arbitrary SQL commands via vectors involving a (1) HTML entity or (2) display name. NOTE: some of these details are obtained from third party information."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "simplemachines-spoofing-unspecified(70617)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/70617"
},
{
"name": "46386",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/46386"
},
{
"name": "[oss-security] 20111010 Re: CVE request: simple machines forum before 2.0.1 and 1.1.15",
"refsource": "MLIST",
"url": "http://openwall.com/lists/oss-security/2011/10/10/6"
},
{
"name": "[oss-security] 20111009 CVE request: simple machines forum before 2.0.1 and 1.1.15",
"refsource": "MLIST",
"url": "http://openwall.com/lists/oss-security/2011/10/09/3"
},
{
"name": "http://www.simplemachines.org/community/index.php?topic=452888.0",
"refsource": "CONFIRM",
"url": "http://www.simplemachines.org/community/index.php?topic=452888.0"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2011-3615",
"datePublished": "2011-10-24T17:00:00",
"dateReserved": "2011-09-21T00:00:00",
"dateUpdated": "2024-08-06T23:37:48.639Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2011-1127 (GCVE-0-2011-1127)
Vulnerability from cvelistv5
Published
2011-06-21 01:00
Modified
2024-09-17 03:23
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
SSI.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, does not properly restrict guest access, which allows remote attackers to have an unspecified impact via unknown vectors.
References
| ► | URL | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T22:14:27.946Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20110222 CVE request: simple machines forum before 1.1.13",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2011/02/22/17"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.simplemachines.org/community/index.php?topic=421547.0"
},
{
"name": "[oss-security] 20110302 Re: CVE request: simple machines forum before 1.1.13",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2011/03/02/4"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SSI.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, does not properly restrict guest access, which allows remote attackers to have an unspecified impact via unknown vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2011-06-21T01:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[oss-security] 20110222 CVE request: simple machines forum before 1.1.13",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2011/02/22/17"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.simplemachines.org/community/index.php?topic=421547.0"
},
{
"name": "[oss-security] 20110302 Re: CVE request: simple machines forum before 1.1.13",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2011/03/02/4"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2011-1127",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "SSI.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, does not properly restrict guest access, which allows remote attackers to have an unspecified impact via unknown vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[oss-security] 20110222 CVE request: simple machines forum before 1.1.13",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2011/02/22/17"
},
{
"name": "http://www.simplemachines.org/community/index.php?topic=421547.0",
"refsource": "CONFIRM",
"url": "http://www.simplemachines.org/community/index.php?topic=421547.0"
},
{
"name": "[oss-security] 20110302 Re: CVE request: simple machines forum before 1.1.13",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2011/03/02/4"
},
{
"name": "http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip",
"refsource": "CONFIRM",
"url": "http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2011-1127",
"datePublished": "2011-06-21T01:00:00Z",
"dateReserved": "2011-03-02T00:00:00Z",
"dateUpdated": "2024-09-17T03:23:36.103Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2011-1129 (GCVE-0-2011-1129)
Vulnerability from cvelistv5
Published
2011-06-21 01:00
Modified
2024-09-16 20:37
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Cross-site scripting (XSS) vulnerability in the EditNews function in ManageNews.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, might allow remote authenticated users to inject arbitrary web script or HTML via a save_items action.
References
| ► | URL | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T22:14:27.834Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20110222 CVE request: simple machines forum before 1.1.13",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2011/02/22/17"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.simplemachines.org/community/index.php?topic=421547.0"
},
{
"name": "[oss-security] 20110302 Re: CVE request: simple machines forum before 1.1.13",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2011/03/02/4"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the EditNews function in ManageNews.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, might allow remote authenticated users to inject arbitrary web script or HTML via a save_items action."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2011-06-21T01:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[oss-security] 20110222 CVE request: simple machines forum before 1.1.13",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2011/02/22/17"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.simplemachines.org/community/index.php?topic=421547.0"
},
{
"name": "[oss-security] 20110302 Re: CVE request: simple machines forum before 1.1.13",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2011/03/02/4"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2011-1129",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the EditNews function in ManageNews.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, might allow remote authenticated users to inject arbitrary web script or HTML via a save_items action."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[oss-security] 20110222 CVE request: simple machines forum before 1.1.13",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2011/02/22/17"
},
{
"name": "http://www.simplemachines.org/community/index.php?topic=421547.0",
"refsource": "CONFIRM",
"url": "http://www.simplemachines.org/community/index.php?topic=421547.0"
},
{
"name": "[oss-security] 20110302 Re: CVE request: simple machines forum before 1.1.13",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2011/03/02/4"
},
{
"name": "http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip",
"refsource": "CONFIRM",
"url": "http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2011-1129",
"datePublished": "2011-06-21T01:00:00Z",
"dateReserved": "2011-03-02T00:00:00Z",
"dateUpdated": "2024-09-16T20:37:33.702Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2008-6971 (GCVE-0-2008-6971)
Vulnerability from cvelistv5
Published
2009-08-13 16:00
Modified
2024-08-07 11:49
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
The password reset functionality in Simple Machines Forum (SMF) 1.0.x before 1.0.14, 1.1.x before 1.1.6, and 2.0 before 2.0 beta 4 includes clues about the random number generator state within a hidden form field and generates predictable validation codes, which allows remote attackers to modify passwords of other users and gain privileges.
References
| ► | URL | Tags | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T11:49:02.602Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "smf-password-reset-security-bypass(44931)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44931"
},
{
"name": "31053",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/31053"
},
{
"name": "47945",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/47945"
},
{
"name": "31750",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/31750"
},
{
"name": "6392",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/6392"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.simplemachines.org/community/index.php?topic=260145.0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-09-06T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The password reset functionality in Simple Machines Forum (SMF) 1.0.x before 1.0.14, 1.1.x before 1.1.6, and 2.0 before 2.0 beta 4 includes clues about the random number generator state within a hidden form field and generates predictable validation codes, which allows remote attackers to modify passwords of other users and gain privileges."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-09-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "smf-password-reset-security-bypass(44931)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44931"
},
{
"name": "31053",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/31053"
},
{
"name": "47945",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/47945"
},
{
"name": "31750",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/31750"
},
{
"name": "6392",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/6392"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.simplemachines.org/community/index.php?topic=260145.0"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-6971",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The password reset functionality in Simple Machines Forum (SMF) 1.0.x before 1.0.14, 1.1.x before 1.1.6, and 2.0 before 2.0 beta 4 includes clues about the random number generator state within a hidden form field and generates predictable validation codes, which allows remote attackers to modify passwords of other users and gain privileges."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "smf-password-reset-security-bypass(44931)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44931"
},
{
"name": "31053",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/31053"
},
{
"name": "47945",
"refsource": "OSVDB",
"url": "http://osvdb.org/47945"
},
{
"name": "31750",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/31750"
},
{
"name": "6392",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/6392"
},
{
"name": "http://www.simplemachines.org/community/index.php?topic=260145.0",
"refsource": "CONFIRM",
"url": "http://www.simplemachines.org/community/index.php?topic=260145.0"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-6971",
"datePublished": "2009-08-13T16:00:00",
"dateReserved": "2009-08-13T00:00:00",
"dateUpdated": "2024-08-07T11:49:02.602Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2011-1130 (GCVE-0-2011-1130)
Vulnerability from cvelistv5
Published
2011-06-21 01:00
Modified
2024-09-16 17:15
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, does not properly validate the start parameter, which might allow remote attackers to conduct SQL injection attacks, obtain sensitive information, or cause a denial of service via a crafted value, related to the cleanRequest function in QueryString.php and the constructPageIndex function in Subs.php.
References
| ► | URL | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T22:14:27.842Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20110222 CVE request: simple machines forum before 1.1.13",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2011/02/22/17"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.simplemachines.org/community/index.php?topic=421547.0"
},
{
"name": "[oss-security] 20110302 Re: CVE request: simple machines forum before 1.1.13",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2011/03/02/4"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, does not properly validate the start parameter, which might allow remote attackers to conduct SQL injection attacks, obtain sensitive information, or cause a denial of service via a crafted value, related to the cleanRequest function in QueryString.php and the constructPageIndex function in Subs.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2011-06-21T01:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[oss-security] 20110222 CVE request: simple machines forum before 1.1.13",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2011/02/22/17"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.simplemachines.org/community/index.php?topic=421547.0"
},
{
"name": "[oss-security] 20110302 Re: CVE request: simple machines forum before 1.1.13",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2011/03/02/4"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2011-1130",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, does not properly validate the start parameter, which might allow remote attackers to conduct SQL injection attacks, obtain sensitive information, or cause a denial of service via a crafted value, related to the cleanRequest function in QueryString.php and the constructPageIndex function in Subs.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[oss-security] 20110222 CVE request: simple machines forum before 1.1.13",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2011/02/22/17"
},
{
"name": "http://www.simplemachines.org/community/index.php?topic=421547.0",
"refsource": "CONFIRM",
"url": "http://www.simplemachines.org/community/index.php?topic=421547.0"
},
{
"name": "[oss-security] 20110302 Re: CVE request: simple machines forum before 1.1.13",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2011/03/02/4"
},
{
"name": "http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip",
"refsource": "CONFIRM",
"url": "http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2011-1130",
"datePublished": "2011-06-21T01:00:00Z",
"dateReserved": "2011-03-02T00:00:00Z",
"dateUpdated": "2024-09-16T17:15:00.759Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-2583 (GCVE-0-2025-2583)
Vulnerability from cvelistv5
Published
2025-03-21 06:31
Modified
2025-04-21 12:41
Severity ?
5.1 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
3.5 (Low) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
3.5 (Low) - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
3.5 (Low) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
3.5 (Low) - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
VLAI Severity ?
EPSS score ?
Summary
A vulnerability was found in SimpleMachines SMF 2.1.4. It has been classified as problematic. This affects an unknown part of the file ManageNews.php. The manipulation of the argument subject/message leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor does not declare this issue a security vulnerability due to authentication requirements before being able to access any feature in the software that allows file modification.
References
| ► | URL | Tags | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| SimpleMachines | SMF |
Version: 2.1.4 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-2583",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-21T12:46:42.953502Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-21T12:47:00.508Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "SMF",
"vendor": "SimpleMachines",
"versions": [
{
"status": "affected",
"version": "2.1.4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Fewwords (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in SimpleMachines SMF 2.1.4. It has been classified as problematic. This affects an unknown part of the file ManageNews.php. The manipulation of the argument subject/message leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor does not declare this issue a security vulnerability due to authentication requirements before being able to access any feature in the software that allows file modification."
},
{
"lang": "de",
"value": "Es wurde eine Schwachstelle in SimpleMachines SMF 2.1.4 ausgemacht. Sie wurde als problematisch eingestuft. Dabei betrifft es einen unbekannter Codeteil der Datei ManageNews.php. Dank Manipulation des Arguments subject/message mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung. Die wahre Existenz der vermeintlichen Schwachstelle wird zur Zeit in Frage gestellt."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-21T12:41:44.675Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-300543 | SimpleMachines SMF ManageNews.php cross site scripting",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.300543"
},
{
"name": "VDB-300543 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.300543"
},
{
"name": "Submit #512001 | SimpleMachines SMF 2.1.4 Cross Site Scripting",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.512001"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/Fewword/Poc/blob/main/smf/smf-poc5.md"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/Fewword/Poc/blob/main/smf/smf-poc6.md"
}
],
"tags": [
"disputed"
],
"timeline": [
{
"lang": "en",
"time": "2025-03-20T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-03-20T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-04-21T14:46:37.000Z",
"value": "VulDB entry last update"
}
],
"title": "SimpleMachines SMF ManageNews.php cross site scripting"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-2583",
"datePublished": "2025-03-21T06:31:06.127Z",
"dateReserved": "2025-03-20T22:59:17.047Z",
"dateUpdated": "2025-04-21T12:41:44.675Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2011-4173 (GCVE-0-2011-4173)
Vulnerability from cvelistv5
Published
2011-10-24 18:00
Modified
2024-09-16 19:25
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Cross-site request forgery (CSRF) vulnerability in Simple Machines Forum (SMF) 2.x before 2.0.1 allows remote attackers to hijack the authentication of administrators or moderators via vectors involving image files, a different vulnerability than CVE-2011-3615. NOTE: some of these details are obtained from third party information.
References
| ► | URL | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T00:01:51.060Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "46386",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/46386"
},
{
"name": "[oss-security] 20111010 Re: CVE request: simple machines forum before 2.0.1 and 1.1.15",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://openwall.com/lists/oss-security/2011/10/10/6"
},
{
"name": "[oss-security] 20111009 CVE request: simple machines forum before 2.0.1 and 1.1.15",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://openwall.com/lists/oss-security/2011/10/09/3"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.simplemachines.org/community/index.php?topic=452888.0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability in Simple Machines Forum (SMF) 2.x before 2.0.1 allows remote attackers to hijack the authentication of administrators or moderators via vectors involving image files, a different vulnerability than CVE-2011-3615. NOTE: some of these details are obtained from third party information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2011-10-24T18:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "46386",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/46386"
},
{
"name": "[oss-security] 20111010 Re: CVE request: simple machines forum before 2.0.1 and 1.1.15",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://openwall.com/lists/oss-security/2011/10/10/6"
},
{
"name": "[oss-security] 20111009 CVE request: simple machines forum before 2.0.1 and 1.1.15",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://openwall.com/lists/oss-security/2011/10/09/3"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.simplemachines.org/community/index.php?topic=452888.0"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2011-4173",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site request forgery (CSRF) vulnerability in Simple Machines Forum (SMF) 2.x before 2.0.1 allows remote attackers to hijack the authentication of administrators or moderators via vectors involving image files, a different vulnerability than CVE-2011-3615. NOTE: some of these details are obtained from third party information."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "46386",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/46386"
},
{
"name": "[oss-security] 20111010 Re: CVE request: simple machines forum before 2.0.1 and 1.1.15",
"refsource": "MLIST",
"url": "http://openwall.com/lists/oss-security/2011/10/10/6"
},
{
"name": "[oss-security] 20111009 CVE request: simple machines forum before 2.0.1 and 1.1.15",
"refsource": "MLIST",
"url": "http://openwall.com/lists/oss-security/2011/10/09/3"
},
{
"name": "http://www.simplemachines.org/community/index.php?topic=452888.0",
"refsource": "CONFIRM",
"url": "http://www.simplemachines.org/community/index.php?topic=452888.0"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2011-4173",
"datePublished": "2011-10-24T18:00:00Z",
"dateReserved": "2011-10-24T00:00:00Z",
"dateUpdated": "2024-09-16T19:25:53.265Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2006-4564 (GCVE-0-2006-4564)
Vulnerability from cvelistv5
Published
2006-09-06 01:00
Modified
2024-08-07 19:14
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
SQL injection vulnerability in Sources/ManageBoards.php in Simple Machines Forum 1.1 RC3 allows remote attackers to execute arbitrary SQL commands via the cur_cat parameter.
References
| ► | URL | Tags | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T19:14:47.626Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "smf-manageboards-sql-injection(28716)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28716"
},
{
"name": "20060901 Sql injection in SMF [Admin section]",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2006-09/0009.html"
},
{
"name": "21740",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/21740"
},
{
"name": "1506",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/1506"
},
{
"name": "ADV-2006-3435",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/3435"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-09-04T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in Sources/ManageBoards.php in Simple Machines Forum 1.1 RC3 allows remote attackers to execute arbitrary SQL commands via the cur_cat parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-19T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "smf-manageboards-sql-injection(28716)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28716"
},
{
"name": "20060901 Sql injection in SMF [Admin section]",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2006-09/0009.html"
},
{
"name": "21740",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/21740"
},
{
"name": "1506",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/1506"
},
{
"name": "ADV-2006-3435",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/3435"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-4564",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "SQL injection vulnerability in Sources/ManageBoards.php in Simple Machines Forum 1.1 RC3 allows remote attackers to execute arbitrary SQL commands via the cur_cat parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "smf-manageboards-sql-injection(28716)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28716"
},
{
"name": "20060901 Sql injection in SMF [Admin section]",
"refsource": "BUGTRAQ",
"url": "http://archives.neohapsis.com/archives/bugtraq/2006-09/0009.html"
},
{
"name": "21740",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/21740"
},
{
"name": "1506",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/1506"
},
{
"name": "ADV-2006-3435",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/3435"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-4564",
"datePublished": "2006-09-06T01:00:00",
"dateReserved": "2006-09-05T00:00:00",
"dateUpdated": "2024-08-07T19:14:47.626Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-7438 (GCVE-0-2024-7438)
Vulnerability from cvelistv5
Published
2024-08-03 15:31
Modified
2024-08-10 06:26
Severity ?
5.3 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
4.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
4.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
VLAI Severity ?
EPSS score ?
CWE
- CWE-99 - Improper Control of Resource Identifiers
Summary
A vulnerability has been found in SimpleMachines SMF 2.1.4 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /index.php?action=profile;u=2;area=showalerts;do=read of the component User Alert Read Status Handler. The manipulation of the argument aid leads to improper control of resource identifiers. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
References
| ► | URL | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| SimpleMachines | SMF |
Version: 2.1.4 |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:simplemachines:simple_machines_forum:2.1.4:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "simple_machines_forum",
"vendor": "simplemachines",
"versions": [
{
"status": "affected",
"version": "2.1.4"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-7438",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-07T16:07:57.411421Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-07T16:10:53.933Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"User Alert Read Status Handler"
],
"product": "SMF",
"vendor": "SimpleMachines",
"versions": [
{
"status": "affected",
"version": "2.1.4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Fewwords (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in SimpleMachines SMF 2.1.4 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /index.php?action=profile;u=2;area=showalerts;do=read of the component User Alert Read Status Handler. The manipulation of the argument aid leads to improper control of resource identifiers. The attack can be launched remotely. The exploit has been disclosed to the public and may be used."
},
{
"lang": "de",
"value": "In SimpleMachines SMF 2.1.4 wurde eine Schwachstelle gefunden. Sie wurde als problematisch eingestuft. Dabei geht es um eine nicht genauer bekannte Funktion der Datei /index.php?action=profile;u=2;area=showalerts;do=read der Komponente User Alert Read Status Handler. Durch Manipulieren des Arguments aid mit unbekannten Daten kann eine improper control of resource identifiers-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-99",
"description": "CWE-99 Improper Control of Resource Identifiers",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-10T06:26:12.241Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-273523 | SimpleMachines SMF User Alert Read Status index.php resource injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.273523"
},
{
"name": "VDB-273523 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.273523"
},
{
"name": "Submit #380190 | SimpleMachines SMF 2.1.4 Insecure Direct Object Reference",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.380190"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/Fewword/Poc/blob/main/smf/smf-poc2.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-08-02T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2024-08-02T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2024-08-10T08:31:06.000Z",
"value": "VulDB entry last update"
}
],
"title": "SimpleMachines SMF User Alert Read Status index.php resource injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2024-7438",
"datePublished": "2024-08-03T15:31:03.669Z",
"dateReserved": "2024-08-02T21:22:28.219Z",
"dateUpdated": "2024-08-10T06:26:12.241Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Vulnerability from fkie_nvd
Published
2011-06-21 02:52
Modified
2025-04-11 00:51
Severity ?
Summary
The PlushSearch2 function in Search.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, uses certain cached data in a situation where a temporary table has been created, even though this cached data is intended only for situations where a temporary table has not been created, which might allow remote attackers to obtain sensitive information via a search.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:simplemachines:smf:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EFF49A27-0BCD-44BA-B0A7-701BA44F2CE1",
"versionEndIncluding": "1.1.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7A85D503-FACF-4814-8E67-E6EEE93FB23D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0:beta4:*:*:*:*:*:*",
"matchCriteriaId": "C8BA3B1D-A1F6-419B-9944-AF01B785C626",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0:beta4.1:*:*:*:*:*:*",
"matchCriteriaId": "6B164981-7F13-43B3-BA29-4F4D52EAC466",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0:beta5:*:*:*:*:*:*",
"matchCriteriaId": "838FA5D8-79E6-4B42-BC0A-51FEA2515442",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0:beta6:*:*:*:*:*:*",
"matchCriteriaId": "C7CC60C4-EED4-41AA-A5DF-5332E6D66E80",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B9F73B7F-8FF3-4A13-943D-C6BF353A5296",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "63FA8C3A-ACF7-4C97-9380-9E144FDF7DF9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8E019CBA-7837-4260-8A86-559C483E405C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9AD93454-C8FA-4966-96D1-AA7DFA0D3C47",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "07D1D8AB-9927-41D5-A81B-B035B661D7E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "543D57E7-B3D0-4714-B5FB-336A1627E1A8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "6FECEABB-BE07-412B-9A08-EAC79A5215D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "2A55E760-7CD8-4590-86B9-11ACA1202A23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "1397297A-7087-42AD-B3D6-1DAA71D3E6DB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "A5F0958C-8FC7-44B2-819D-6688A7D40632",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "A454C424-E1CD-46A4-A9AC-12BB22400D64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "732474E6-B87C-4AFA-9868-3559634A688D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "A3F625DB-65E9-41FB-B733-CC4AEF1B9895",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.13:*:*:*:*:*:*:*",
"matchCriteriaId": "DD622FF4-C724-4D50-9712-5E632F3E83CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.14:*:*:*:*:*:*:*",
"matchCriteriaId": "D01CD63D-16B7-4D98-9E67-CF0838A65FFF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.15:*:*:*:*:*:*:*",
"matchCriteriaId": "46A72FB0-88A3-4E2E-B34C-E51EE91A51E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.16:*:*:*:*:*:*:*",
"matchCriteriaId": "79296012-575A-42EC-9E9A-4549346D7475",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.17:*:*:*:*:*:*:*",
"matchCriteriaId": "25089E42-354D-4A0C-8845-01F6800446D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.18:*:*:*:*:*:*:*",
"matchCriteriaId": "60A992F6-5BD0-458B-A813-6EA539249FAA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.19:*:*:*:*:*:*:*",
"matchCriteriaId": "A8C8198A-38C0-481A-BDBE-D193E69C5462",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.20:*:*:*:*:*:*:*",
"matchCriteriaId": "95AE6F3E-1B4C-425B-8B9C-DD32B534F234",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.21:*:*:*:*:*:*:*",
"matchCriteriaId": "71405233-0271-4081-B082-208A74B2E8B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "682BE6FC-F9FC-4C90-A56B-EC05B518C55F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:beta1:*:*:*:*:*:*",
"matchCriteriaId": "7122D896-354C-4E62-B507-1898DEC6F00E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:beta2:*:*:*:*:*:*",
"matchCriteriaId": "17C92F5C-C1C9-4D05-B096-755CC6DFAA51",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:beta3:*:*:*:*:*:*",
"matchCriteriaId": "268C6140-13DE-43F2-958D-7882AC342E2C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:beta4:*:*:*:*:*:*",
"matchCriteriaId": "755E8504-6C4A-467A-835B-222EEB77CE8F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "EB5AF099-0B41-48C6-810E-A4AF7B3EB646",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "4CFE75DC-93E1-487B-B50C-1465A98956AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:rc3:*:*:*:*:*:*",
"matchCriteriaId": "920956A5-C343-4FCF-9BF3-F4E8C79F9993",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1539E360-712B-4DF1-813C-82F87C0946FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2530C440-9C8C-4966-88B0-176D8FEBDFB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "565A8842-9B1E-4764-85E2-021F7825A1CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "603B3808-FDFF-432E-8937-984897377BB8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B5656FF9-3F20-476C-A3F7-69EED049E669",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "5187CA56-26DD-4042-82DC-FCD0CB8A84FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "DB527C06-DEAB-416D-ABBD-F0A7F33F91D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "4A8C2083-53A9-4E71-A268-D8690A288F8A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.9:*:*:*:*:*:*:*",
"matchCriteriaId": "0127EAC8-B363-4262-B80E-FF7415701038",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.10:*:*:*:*:*:*:*",
"matchCriteriaId": "D6FEC752-D94D-4D0D-BC96-82654F69144D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.11:*:*:*:*:*:*:*",
"matchCriteriaId": "E5188CC8-45B8-4A07-B474-6B92C7F15276",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "AFBA92BD-F323-4786-A31E-E01642CFD415",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:beta2:*:*:*:*:*:*",
"matchCriteriaId": "CE71E13C-0DDE-46ED-99E1-0D71E6539EE9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:beta2.1:*:*:*:*:*:*",
"matchCriteriaId": "E54A4CD9-AB69-4DF9-AA3A-0C3A0532FF15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:beta3:*:*:*:*:*:*",
"matchCriteriaId": "D6BDF574-AD5F-44AB-95AB-1790E4563977",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:beta3.1:*:*:*:*:*:*",
"matchCriteriaId": "62B1D7AB-039A-4496-A55C-6BFCFC40BD37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:beta4:*:*:*:*:*:*",
"matchCriteriaId": "804FC715-BF72-4E2D-8129-6E499E3F48F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B4B5EA47-4175-4E39-A2E8-66CF592DFA48",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "3DE1E832-43E7-4650-9F48-FDEEB75C1B93",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "FEEDEDCF-E956-4F2E-B13D-9E63DF6B31AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:rc4:*:*:*:*:*:*",
"matchCriteriaId": "5582EEF9-33A8-42C0-A2BF-E0A1EA431187",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The PlushSearch2 function in Search.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, uses certain cached data in a situation where a temporary table has been created, even though this cached data is intended only for situations where a temporary table has not been created, which might allow remote attackers to obtain sensitive information via a search."
},
{
"lang": "es",
"value": "La funci\u00f3n PlushSearch2 en Search.php de Simple Machines Forum (SMF)antes de v1.1.13 y v2.x antes de v2.0 RC5, usa ciertos datos almacenados en cach\u00e9 en una situaci\u00f3n en la que ha sido creada una tabla temporal , a pesar de estos datos en cach\u00e9 solo se usan en situaciones en las que una tabla temporal no se ha creado, lo que podr\u00eda permitir a atacantes remotos obtener informaci\u00f3n sensible a trav\u00e9s de una b\u00fasqueda."
}
],
"id": "CVE-2011-1131",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2011-06-21T02:52:42.467",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.openwall.com/lists/oss-security/2011/02/22/17"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.openwall.com/lists/oss-security/2011/03/02/4"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.simplemachines.org/community/index.php?topic=421547.0"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.openwall.com/lists/oss-security/2011/02/22/17"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.openwall.com/lists/oss-security/2011/03/02/4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.simplemachines.org/community/index.php?topic=421547.0"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-06-21 02:52
Modified
2025-04-11 00:51
Severity ?
Summary
SSI.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, does not properly restrict guest access, which allows remote attackers to have an unspecified impact via unknown vectors.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:simplemachines:smf:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EFF49A27-0BCD-44BA-B0A7-701BA44F2CE1",
"versionEndIncluding": "1.1.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7A85D503-FACF-4814-8E67-E6EEE93FB23D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0:beta4:*:*:*:*:*:*",
"matchCriteriaId": "C8BA3B1D-A1F6-419B-9944-AF01B785C626",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0:beta4.1:*:*:*:*:*:*",
"matchCriteriaId": "6B164981-7F13-43B3-BA29-4F4D52EAC466",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0:beta5:*:*:*:*:*:*",
"matchCriteriaId": "838FA5D8-79E6-4B42-BC0A-51FEA2515442",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0:beta6:*:*:*:*:*:*",
"matchCriteriaId": "C7CC60C4-EED4-41AA-A5DF-5332E6D66E80",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B9F73B7F-8FF3-4A13-943D-C6BF353A5296",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "63FA8C3A-ACF7-4C97-9380-9E144FDF7DF9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8E019CBA-7837-4260-8A86-559C483E405C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9AD93454-C8FA-4966-96D1-AA7DFA0D3C47",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "07D1D8AB-9927-41D5-A81B-B035B661D7E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "543D57E7-B3D0-4714-B5FB-336A1627E1A8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "6FECEABB-BE07-412B-9A08-EAC79A5215D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "2A55E760-7CD8-4590-86B9-11ACA1202A23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "1397297A-7087-42AD-B3D6-1DAA71D3E6DB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "A5F0958C-8FC7-44B2-819D-6688A7D40632",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "A454C424-E1CD-46A4-A9AC-12BB22400D64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "732474E6-B87C-4AFA-9868-3559634A688D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "A3F625DB-65E9-41FB-B733-CC4AEF1B9895",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.13:*:*:*:*:*:*:*",
"matchCriteriaId": "DD622FF4-C724-4D50-9712-5E632F3E83CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.14:*:*:*:*:*:*:*",
"matchCriteriaId": "D01CD63D-16B7-4D98-9E67-CF0838A65FFF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.15:*:*:*:*:*:*:*",
"matchCriteriaId": "46A72FB0-88A3-4E2E-B34C-E51EE91A51E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.16:*:*:*:*:*:*:*",
"matchCriteriaId": "79296012-575A-42EC-9E9A-4549346D7475",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.17:*:*:*:*:*:*:*",
"matchCriteriaId": "25089E42-354D-4A0C-8845-01F6800446D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.18:*:*:*:*:*:*:*",
"matchCriteriaId": "60A992F6-5BD0-458B-A813-6EA539249FAA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.19:*:*:*:*:*:*:*",
"matchCriteriaId": "A8C8198A-38C0-481A-BDBE-D193E69C5462",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.20:*:*:*:*:*:*:*",
"matchCriteriaId": "95AE6F3E-1B4C-425B-8B9C-DD32B534F234",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.21:*:*:*:*:*:*:*",
"matchCriteriaId": "71405233-0271-4081-B082-208A74B2E8B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "682BE6FC-F9FC-4C90-A56B-EC05B518C55F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:beta1:*:*:*:*:*:*",
"matchCriteriaId": "7122D896-354C-4E62-B507-1898DEC6F00E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:beta2:*:*:*:*:*:*",
"matchCriteriaId": "17C92F5C-C1C9-4D05-B096-755CC6DFAA51",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:beta3:*:*:*:*:*:*",
"matchCriteriaId": "268C6140-13DE-43F2-958D-7882AC342E2C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:beta4:*:*:*:*:*:*",
"matchCriteriaId": "755E8504-6C4A-467A-835B-222EEB77CE8F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "EB5AF099-0B41-48C6-810E-A4AF7B3EB646",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "4CFE75DC-93E1-487B-B50C-1465A98956AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:rc3:*:*:*:*:*:*",
"matchCriteriaId": "920956A5-C343-4FCF-9BF3-F4E8C79F9993",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1539E360-712B-4DF1-813C-82F87C0946FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2530C440-9C8C-4966-88B0-176D8FEBDFB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "565A8842-9B1E-4764-85E2-021F7825A1CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "603B3808-FDFF-432E-8937-984897377BB8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B5656FF9-3F20-476C-A3F7-69EED049E669",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "5187CA56-26DD-4042-82DC-FCD0CB8A84FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "DB527C06-DEAB-416D-ABBD-F0A7F33F91D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "4A8C2083-53A9-4E71-A268-D8690A288F8A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.9:*:*:*:*:*:*:*",
"matchCriteriaId": "0127EAC8-B363-4262-B80E-FF7415701038",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.10:*:*:*:*:*:*:*",
"matchCriteriaId": "D6FEC752-D94D-4D0D-BC96-82654F69144D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.11:*:*:*:*:*:*:*",
"matchCriteriaId": "E5188CC8-45B8-4A07-B474-6B92C7F15276",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "AFBA92BD-F323-4786-A31E-E01642CFD415",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:beta2:*:*:*:*:*:*",
"matchCriteriaId": "CE71E13C-0DDE-46ED-99E1-0D71E6539EE9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:beta2.1:*:*:*:*:*:*",
"matchCriteriaId": "E54A4CD9-AB69-4DF9-AA3A-0C3A0532FF15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:beta3:*:*:*:*:*:*",
"matchCriteriaId": "D6BDF574-AD5F-44AB-95AB-1790E4563977",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:beta3.1:*:*:*:*:*:*",
"matchCriteriaId": "62B1D7AB-039A-4496-A55C-6BFCFC40BD37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:beta4:*:*:*:*:*:*",
"matchCriteriaId": "804FC715-BF72-4E2D-8129-6E499E3F48F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B4B5EA47-4175-4E39-A2E8-66CF592DFA48",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "3DE1E832-43E7-4650-9F48-FDEEB75C1B93",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "FEEDEDCF-E956-4F2E-B13D-9E63DF6B31AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:rc4:*:*:*:*:*:*",
"matchCriteriaId": "5582EEF9-33A8-42C0-A2BF-E0A1EA431187",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "SSI.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, does not properly restrict guest access, which allows remote attackers to have an unspecified impact via unknown vectors."
},
{
"lang": "es",
"value": "SSI.php en Simple Machines Forum ( SMF ) antes de v1.1.13, y v2.x antes de v2.0 RC5, no restringe correctamente el acceso de invitados, lo que permite a atacantes remotos tener un impacto no especificado a trav\u00e9s de vectores desconocidos."
}
],
"id": "CVE-2011-1127",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2011-06-21T02:52:42.310",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.openwall.com/lists/oss-security/2011/02/22/17"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.openwall.com/lists/oss-security/2011/03/02/4"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.simplemachines.org/community/index.php?topic=421547.0"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.openwall.com/lists/oss-security/2011/02/22/17"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.openwall.com/lists/oss-security/2011/03/02/4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.simplemachines.org/community/index.php?topic=421547.0"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-09-06 01:04
Modified
2025-04-03 01:03
Severity ?
Summary
SQL injection vulnerability in Sources/ManageBoards.php in Simple Machines Forum 1.1 RC3 allows remote attackers to execute arbitrary SQL commands via the cur_cat parameter.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| simplemachines | smf | 1.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:rc3:*:*:*:*:*:*",
"matchCriteriaId": "920956A5-C343-4FCF-9BF3-F4E8C79F9993",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in Sources/ManageBoards.php in Simple Machines Forum 1.1 RC3 allows remote attackers to execute arbitrary SQL commands via the cur_cat parameter."
},
{
"lang": "es",
"value": "Vulnerabilidad de inyecci\u00f3n SQL en Sources/ManageBoards.php en Simple Machines Forum 1.1 RC3 permite a un atacante remoto ejecutar comandos SQL de su elecci\u00f3n a trav\u00e9s del par\u00e1metro cur_cat."
}
],
"evaluatorSolution": "Successful exploitation requires privileges to add a new board.",
"id": "CVE-2006-4564",
"lastModified": "2025-04-03T01:03:51.193",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-09-06T01:04:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://archives.neohapsis.com/archives/bugtraq/2006-09/0009.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/21740"
},
{
"source": "cve@mitre.org",
"url": "http://securityreason.com/securityalert/1506"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2006/3435"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28716"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://archives.neohapsis.com/archives/bugtraq/2006-09/0009.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/21740"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/1506"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2006/3435"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28716"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2009-08-13 16:30
Modified
2025-04-09 00:30
Severity ?
Summary
The password reset functionality in Simple Machines Forum (SMF) 1.0.x before 1.0.14, 1.1.x before 1.1.6, and 2.0 before 2.0 beta 4 includes clues about the random number generator state within a hidden form field and generates predictable validation codes, which allows remote attackers to modify passwords of other users and gain privileges.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| simplemachines | smf | 1.0.12 | |
| simplemachines | smf | 1.0.13 | |
| simplemachines | smf | 1.1.4 | |
| simplemachines | smf | 1.1.5 | |
| simplemachines | smf | 2.0 | |
| simplemachines | smf | 2.0-beta2 | |
| simplemachines | smf | 2.0-beta3 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "A3F625DB-65E9-41FB-B733-CC4AEF1B9895",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.13:*:*:*:*:*:*:*",
"matchCriteriaId": "DD622FF4-C724-4D50-9712-5E632F3E83CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "603B3808-FDFF-432E-8937-984897377BB8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B5656FF9-3F20-476C-A3F7-69EED049E669",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:rc1.2:*:*:*:*:*:*",
"matchCriteriaId": "B37BDC8B-C00C-4443-A1DD-C1823E064940",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0-beta2:*:*:*:*:*:*:*",
"matchCriteriaId": "5567FA10-E124-496B-A9FB-BE8915842792",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0-beta3:*:*:*:*:*:*:*",
"matchCriteriaId": "25997E1A-8BC3-4366-A731-1F826F60EE99",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The password reset functionality in Simple Machines Forum (SMF) 1.0.x before 1.0.14, 1.1.x before 1.1.6, and 2.0 before 2.0 beta 4 includes clues about the random number generator state within a hidden form field and generates predictable validation codes, which allows remote attackers to modify passwords of other users and gain privileges."
},
{
"lang": "es",
"value": "La funcionalidad de reinicio de contrase\u00f1a en Simple Machines Forum (SMF) v1.0.x anteriores a v1.0.14, v1.1.x anteriores a v1.1.6, y v2.0 anteriores a v2.0 beta 4 incluye pistas acerca del estado del generador de n\u00famero aleatorios con un campo del formulario escondido y genera c\u00f3digos validados predecibles, lo que permite a los atacantes remotos, modificar la contrase\u00f1a de otros usuario y obtener privilegios."
}
],
"id": "CVE-2008-6971",
"lastModified": "2025-04-09T00:30:58.490",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2009-08-13T16:30:01.187",
"references": [
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/47945"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/31750"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/31053"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.simplemachines.org/community/index.php?topic=260145.0"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44931"
},
{
"source": "cve@mitre.org",
"url": "https://www.exploit-db.com/exploits/6392"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/47945"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/31750"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/31053"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.simplemachines.org/community/index.php?topic=260145.0"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44931"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.exploit-db.com/exploits/6392"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-255"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-06-21 02:52
Modified
2025-04-11 00:51
Severity ?
Summary
The loadUserSettings function in Load.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, does not properly handle invalid login attempts, which might make it easier for remote attackers to obtain access or cause a denial of service via a brute-force attack.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:simplemachines:smf:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EFF49A27-0BCD-44BA-B0A7-701BA44F2CE1",
"versionEndIncluding": "1.1.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7A85D503-FACF-4814-8E67-E6EEE93FB23D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0:beta4:*:*:*:*:*:*",
"matchCriteriaId": "C8BA3B1D-A1F6-419B-9944-AF01B785C626",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0:beta4.1:*:*:*:*:*:*",
"matchCriteriaId": "6B164981-7F13-43B3-BA29-4F4D52EAC466",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0:beta5:*:*:*:*:*:*",
"matchCriteriaId": "838FA5D8-79E6-4B42-BC0A-51FEA2515442",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0:beta6:*:*:*:*:*:*",
"matchCriteriaId": "C7CC60C4-EED4-41AA-A5DF-5332E6D66E80",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B9F73B7F-8FF3-4A13-943D-C6BF353A5296",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "63FA8C3A-ACF7-4C97-9380-9E144FDF7DF9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8E019CBA-7837-4260-8A86-559C483E405C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9AD93454-C8FA-4966-96D1-AA7DFA0D3C47",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "07D1D8AB-9927-41D5-A81B-B035B661D7E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "543D57E7-B3D0-4714-B5FB-336A1627E1A8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "6FECEABB-BE07-412B-9A08-EAC79A5215D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "2A55E760-7CD8-4590-86B9-11ACA1202A23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "1397297A-7087-42AD-B3D6-1DAA71D3E6DB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "A5F0958C-8FC7-44B2-819D-6688A7D40632",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "A454C424-E1CD-46A4-A9AC-12BB22400D64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "732474E6-B87C-4AFA-9868-3559634A688D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "A3F625DB-65E9-41FB-B733-CC4AEF1B9895",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.13:*:*:*:*:*:*:*",
"matchCriteriaId": "DD622FF4-C724-4D50-9712-5E632F3E83CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.14:*:*:*:*:*:*:*",
"matchCriteriaId": "D01CD63D-16B7-4D98-9E67-CF0838A65FFF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.15:*:*:*:*:*:*:*",
"matchCriteriaId": "46A72FB0-88A3-4E2E-B34C-E51EE91A51E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.16:*:*:*:*:*:*:*",
"matchCriteriaId": "79296012-575A-42EC-9E9A-4549346D7475",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.17:*:*:*:*:*:*:*",
"matchCriteriaId": "25089E42-354D-4A0C-8845-01F6800446D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.18:*:*:*:*:*:*:*",
"matchCriteriaId": "60A992F6-5BD0-458B-A813-6EA539249FAA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.19:*:*:*:*:*:*:*",
"matchCriteriaId": "A8C8198A-38C0-481A-BDBE-D193E69C5462",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.20:*:*:*:*:*:*:*",
"matchCriteriaId": "95AE6F3E-1B4C-425B-8B9C-DD32B534F234",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.21:*:*:*:*:*:*:*",
"matchCriteriaId": "71405233-0271-4081-B082-208A74B2E8B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "682BE6FC-F9FC-4C90-A56B-EC05B518C55F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:beta1:*:*:*:*:*:*",
"matchCriteriaId": "7122D896-354C-4E62-B507-1898DEC6F00E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:beta2:*:*:*:*:*:*",
"matchCriteriaId": "17C92F5C-C1C9-4D05-B096-755CC6DFAA51",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:beta3:*:*:*:*:*:*",
"matchCriteriaId": "268C6140-13DE-43F2-958D-7882AC342E2C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:beta4:*:*:*:*:*:*",
"matchCriteriaId": "755E8504-6C4A-467A-835B-222EEB77CE8F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "EB5AF099-0B41-48C6-810E-A4AF7B3EB646",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "4CFE75DC-93E1-487B-B50C-1465A98956AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:rc3:*:*:*:*:*:*",
"matchCriteriaId": "920956A5-C343-4FCF-9BF3-F4E8C79F9993",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1539E360-712B-4DF1-813C-82F87C0946FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2530C440-9C8C-4966-88B0-176D8FEBDFB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "565A8842-9B1E-4764-85E2-021F7825A1CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "603B3808-FDFF-432E-8937-984897377BB8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B5656FF9-3F20-476C-A3F7-69EED049E669",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "5187CA56-26DD-4042-82DC-FCD0CB8A84FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "DB527C06-DEAB-416D-ABBD-F0A7F33F91D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "4A8C2083-53A9-4E71-A268-D8690A288F8A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.9:*:*:*:*:*:*:*",
"matchCriteriaId": "0127EAC8-B363-4262-B80E-FF7415701038",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.10:*:*:*:*:*:*:*",
"matchCriteriaId": "D6FEC752-D94D-4D0D-BC96-82654F69144D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.11:*:*:*:*:*:*:*",
"matchCriteriaId": "E5188CC8-45B8-4A07-B474-6B92C7F15276",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "AFBA92BD-F323-4786-A31E-E01642CFD415",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:beta2:*:*:*:*:*:*",
"matchCriteriaId": "CE71E13C-0DDE-46ED-99E1-0D71E6539EE9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:beta2.1:*:*:*:*:*:*",
"matchCriteriaId": "E54A4CD9-AB69-4DF9-AA3A-0C3A0532FF15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:beta3:*:*:*:*:*:*",
"matchCriteriaId": "D6BDF574-AD5F-44AB-95AB-1790E4563977",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:beta3.1:*:*:*:*:*:*",
"matchCriteriaId": "62B1D7AB-039A-4496-A55C-6BFCFC40BD37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:beta4:*:*:*:*:*:*",
"matchCriteriaId": "804FC715-BF72-4E2D-8129-6E499E3F48F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B4B5EA47-4175-4E39-A2E8-66CF592DFA48",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "3DE1E832-43E7-4650-9F48-FDEEB75C1B93",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "FEEDEDCF-E956-4F2E-B13D-9E63DF6B31AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:rc4:*:*:*:*:*:*",
"matchCriteriaId": "5582EEF9-33A8-42C0-A2BF-E0A1EA431187",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The loadUserSettings function in Load.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, does not properly handle invalid login attempts, which might make it easier for remote attackers to obtain access or cause a denial of service via a brute-force attack."
},
{
"lang": "es",
"value": "La funci\u00f3n loadUserSettings en ??load.php en Simple Machines Forum (SMF ) antes de v1.1.13, y v2.x antes de v2.0 RC5, no controla correctamente intentos fallidos de inicio de sesi\u00f3n, lo que podr\u00eda facilitar a los atacantes remotos obtener acceso o causar una denegaci\u00f3n de servicio a trav\u00e9s de un ataque de fuerza bruta."
}
],
"id": "CVE-2011-1128",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2011-06-21T02:52:42.343",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.openwall.com/lists/oss-security/2011/02/22/17"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.openwall.com/lists/oss-security/2011/03/02/4"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.simplemachines.org/community/index.php?topic=421547.0"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.openwall.com/lists/oss-security/2011/02/22/17"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.openwall.com/lists/oss-security/2011/03/02/4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.simplemachines.org/community/index.php?topic=421547.0"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-310"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-06-21 02:52
Modified
2025-04-11 00:51
Severity ?
Summary
Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, does not properly validate the start parameter, which might allow remote attackers to conduct SQL injection attacks, obtain sensitive information, or cause a denial of service via a crafted value, related to the cleanRequest function in QueryString.php and the constructPageIndex function in Subs.php.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:simplemachines:smf:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EFF49A27-0BCD-44BA-B0A7-701BA44F2CE1",
"versionEndIncluding": "1.1.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7A85D503-FACF-4814-8E67-E6EEE93FB23D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0:beta4:*:*:*:*:*:*",
"matchCriteriaId": "C8BA3B1D-A1F6-419B-9944-AF01B785C626",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0:beta4.1:*:*:*:*:*:*",
"matchCriteriaId": "6B164981-7F13-43B3-BA29-4F4D52EAC466",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0:beta5:*:*:*:*:*:*",
"matchCriteriaId": "838FA5D8-79E6-4B42-BC0A-51FEA2515442",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0:beta6:*:*:*:*:*:*",
"matchCriteriaId": "C7CC60C4-EED4-41AA-A5DF-5332E6D66E80",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B9F73B7F-8FF3-4A13-943D-C6BF353A5296",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "63FA8C3A-ACF7-4C97-9380-9E144FDF7DF9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8E019CBA-7837-4260-8A86-559C483E405C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9AD93454-C8FA-4966-96D1-AA7DFA0D3C47",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "07D1D8AB-9927-41D5-A81B-B035B661D7E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "543D57E7-B3D0-4714-B5FB-336A1627E1A8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "6FECEABB-BE07-412B-9A08-EAC79A5215D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "2A55E760-7CD8-4590-86B9-11ACA1202A23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "1397297A-7087-42AD-B3D6-1DAA71D3E6DB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "A5F0958C-8FC7-44B2-819D-6688A7D40632",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "A454C424-E1CD-46A4-A9AC-12BB22400D64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "732474E6-B87C-4AFA-9868-3559634A688D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "A3F625DB-65E9-41FB-B733-CC4AEF1B9895",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.13:*:*:*:*:*:*:*",
"matchCriteriaId": "DD622FF4-C724-4D50-9712-5E632F3E83CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.14:*:*:*:*:*:*:*",
"matchCriteriaId": "D01CD63D-16B7-4D98-9E67-CF0838A65FFF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.15:*:*:*:*:*:*:*",
"matchCriteriaId": "46A72FB0-88A3-4E2E-B34C-E51EE91A51E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.16:*:*:*:*:*:*:*",
"matchCriteriaId": "79296012-575A-42EC-9E9A-4549346D7475",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.17:*:*:*:*:*:*:*",
"matchCriteriaId": "25089E42-354D-4A0C-8845-01F6800446D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.18:*:*:*:*:*:*:*",
"matchCriteriaId": "60A992F6-5BD0-458B-A813-6EA539249FAA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.19:*:*:*:*:*:*:*",
"matchCriteriaId": "A8C8198A-38C0-481A-BDBE-D193E69C5462",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.20:*:*:*:*:*:*:*",
"matchCriteriaId": "95AE6F3E-1B4C-425B-8B9C-DD32B534F234",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.21:*:*:*:*:*:*:*",
"matchCriteriaId": "71405233-0271-4081-B082-208A74B2E8B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "682BE6FC-F9FC-4C90-A56B-EC05B518C55F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:beta1:*:*:*:*:*:*",
"matchCriteriaId": "7122D896-354C-4E62-B507-1898DEC6F00E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:beta2:*:*:*:*:*:*",
"matchCriteriaId": "17C92F5C-C1C9-4D05-B096-755CC6DFAA51",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:beta3:*:*:*:*:*:*",
"matchCriteriaId": "268C6140-13DE-43F2-958D-7882AC342E2C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:beta4:*:*:*:*:*:*",
"matchCriteriaId": "755E8504-6C4A-467A-835B-222EEB77CE8F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "EB5AF099-0B41-48C6-810E-A4AF7B3EB646",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "4CFE75DC-93E1-487B-B50C-1465A98956AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:rc3:*:*:*:*:*:*",
"matchCriteriaId": "920956A5-C343-4FCF-9BF3-F4E8C79F9993",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1539E360-712B-4DF1-813C-82F87C0946FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2530C440-9C8C-4966-88B0-176D8FEBDFB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "565A8842-9B1E-4764-85E2-021F7825A1CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "603B3808-FDFF-432E-8937-984897377BB8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B5656FF9-3F20-476C-A3F7-69EED049E669",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "5187CA56-26DD-4042-82DC-FCD0CB8A84FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "DB527C06-DEAB-416D-ABBD-F0A7F33F91D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "4A8C2083-53A9-4E71-A268-D8690A288F8A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.9:*:*:*:*:*:*:*",
"matchCriteriaId": "0127EAC8-B363-4262-B80E-FF7415701038",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.10:*:*:*:*:*:*:*",
"matchCriteriaId": "D6FEC752-D94D-4D0D-BC96-82654F69144D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.11:*:*:*:*:*:*:*",
"matchCriteriaId": "E5188CC8-45B8-4A07-B474-6B92C7F15276",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "AFBA92BD-F323-4786-A31E-E01642CFD415",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:beta2:*:*:*:*:*:*",
"matchCriteriaId": "CE71E13C-0DDE-46ED-99E1-0D71E6539EE9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:beta2.1:*:*:*:*:*:*",
"matchCriteriaId": "E54A4CD9-AB69-4DF9-AA3A-0C3A0532FF15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:beta3:*:*:*:*:*:*",
"matchCriteriaId": "D6BDF574-AD5F-44AB-95AB-1790E4563977",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:beta3.1:*:*:*:*:*:*",
"matchCriteriaId": "62B1D7AB-039A-4496-A55C-6BFCFC40BD37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:beta4:*:*:*:*:*:*",
"matchCriteriaId": "804FC715-BF72-4E2D-8129-6E499E3F48F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B4B5EA47-4175-4E39-A2E8-66CF592DFA48",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "3DE1E832-43E7-4650-9F48-FDEEB75C1B93",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "FEEDEDCF-E956-4F2E-B13D-9E63DF6B31AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:rc4:*:*:*:*:*:*",
"matchCriteriaId": "5582EEF9-33A8-42C0-A2BF-E0A1EA431187",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, does not properly validate the start parameter, which might allow remote attackers to conduct SQL injection attacks, obtain sensitive information, or cause a denial of service via a crafted value, related to the cleanRequest function in QueryString.php and the constructPageIndex function in Subs.php."
},
{
"lang": "es",
"value": "Simple Machines Forum (SMF ) antes de v1.1.13, y v2.x antes de v2.0 RC5, no valida correctamente los par\u00e1metros de inicio, lo que podr\u00eda permitir a atacantes remotos realizar ataques de inyecci\u00f3n SQL, obtener informaci\u00f3n sensible o causar una denegaci\u00f3n de servicio a trav\u00e9s de un valor creado, en relaci\u00f3n con la funci\u00f3n cleanRequest en QueryString.php y la funci\u00f3n constructPageIndex en Subs.php."
}
],
"id": "CVE-2011-1130",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2011-06-21T02:52:42.420",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.openwall.com/lists/oss-security/2011/02/22/17"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.openwall.com/lists/oss-security/2011/03/02/4"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.simplemachines.org/community/index.php?topic=421547.0"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.openwall.com/lists/oss-security/2011/02/22/17"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.openwall.com/lists/oss-security/2011/03/02/4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.simplemachines.org/community/index.php?topic=421547.0"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-06-21 02:52
Modified
2025-04-11 00:51
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the EditNews function in ManageNews.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, might allow remote authenticated users to inject arbitrary web script or HTML via a save_items action.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:simplemachines:smf:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EFF49A27-0BCD-44BA-B0A7-701BA44F2CE1",
"versionEndIncluding": "1.1.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7A85D503-FACF-4814-8E67-E6EEE93FB23D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0:beta4:*:*:*:*:*:*",
"matchCriteriaId": "C8BA3B1D-A1F6-419B-9944-AF01B785C626",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0:beta4.1:*:*:*:*:*:*",
"matchCriteriaId": "6B164981-7F13-43B3-BA29-4F4D52EAC466",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0:beta5:*:*:*:*:*:*",
"matchCriteriaId": "838FA5D8-79E6-4B42-BC0A-51FEA2515442",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0:beta6:*:*:*:*:*:*",
"matchCriteriaId": "C7CC60C4-EED4-41AA-A5DF-5332E6D66E80",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B9F73B7F-8FF3-4A13-943D-C6BF353A5296",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "63FA8C3A-ACF7-4C97-9380-9E144FDF7DF9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8E019CBA-7837-4260-8A86-559C483E405C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9AD93454-C8FA-4966-96D1-AA7DFA0D3C47",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "07D1D8AB-9927-41D5-A81B-B035B661D7E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "543D57E7-B3D0-4714-B5FB-336A1627E1A8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "6FECEABB-BE07-412B-9A08-EAC79A5215D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "2A55E760-7CD8-4590-86B9-11ACA1202A23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "1397297A-7087-42AD-B3D6-1DAA71D3E6DB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "A5F0958C-8FC7-44B2-819D-6688A7D40632",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "A454C424-E1CD-46A4-A9AC-12BB22400D64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "732474E6-B87C-4AFA-9868-3559634A688D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "A3F625DB-65E9-41FB-B733-CC4AEF1B9895",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.13:*:*:*:*:*:*:*",
"matchCriteriaId": "DD622FF4-C724-4D50-9712-5E632F3E83CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.14:*:*:*:*:*:*:*",
"matchCriteriaId": "D01CD63D-16B7-4D98-9E67-CF0838A65FFF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.15:*:*:*:*:*:*:*",
"matchCriteriaId": "46A72FB0-88A3-4E2E-B34C-E51EE91A51E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.16:*:*:*:*:*:*:*",
"matchCriteriaId": "79296012-575A-42EC-9E9A-4549346D7475",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.17:*:*:*:*:*:*:*",
"matchCriteriaId": "25089E42-354D-4A0C-8845-01F6800446D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.18:*:*:*:*:*:*:*",
"matchCriteriaId": "60A992F6-5BD0-458B-A813-6EA539249FAA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.19:*:*:*:*:*:*:*",
"matchCriteriaId": "A8C8198A-38C0-481A-BDBE-D193E69C5462",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.20:*:*:*:*:*:*:*",
"matchCriteriaId": "95AE6F3E-1B4C-425B-8B9C-DD32B534F234",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.21:*:*:*:*:*:*:*",
"matchCriteriaId": "71405233-0271-4081-B082-208A74B2E8B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "682BE6FC-F9FC-4C90-A56B-EC05B518C55F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:beta1:*:*:*:*:*:*",
"matchCriteriaId": "7122D896-354C-4E62-B507-1898DEC6F00E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:beta2:*:*:*:*:*:*",
"matchCriteriaId": "17C92F5C-C1C9-4D05-B096-755CC6DFAA51",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:beta3:*:*:*:*:*:*",
"matchCriteriaId": "268C6140-13DE-43F2-958D-7882AC342E2C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:beta4:*:*:*:*:*:*",
"matchCriteriaId": "755E8504-6C4A-467A-835B-222EEB77CE8F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "EB5AF099-0B41-48C6-810E-A4AF7B3EB646",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "4CFE75DC-93E1-487B-B50C-1465A98956AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:rc3:*:*:*:*:*:*",
"matchCriteriaId": "920956A5-C343-4FCF-9BF3-F4E8C79F9993",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1539E360-712B-4DF1-813C-82F87C0946FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2530C440-9C8C-4966-88B0-176D8FEBDFB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "565A8842-9B1E-4764-85E2-021F7825A1CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "603B3808-FDFF-432E-8937-984897377BB8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B5656FF9-3F20-476C-A3F7-69EED049E669",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "5187CA56-26DD-4042-82DC-FCD0CB8A84FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "DB527C06-DEAB-416D-ABBD-F0A7F33F91D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "4A8C2083-53A9-4E71-A268-D8690A288F8A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.9:*:*:*:*:*:*:*",
"matchCriteriaId": "0127EAC8-B363-4262-B80E-FF7415701038",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.10:*:*:*:*:*:*:*",
"matchCriteriaId": "D6FEC752-D94D-4D0D-BC96-82654F69144D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.11:*:*:*:*:*:*:*",
"matchCriteriaId": "E5188CC8-45B8-4A07-B474-6B92C7F15276",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "AFBA92BD-F323-4786-A31E-E01642CFD415",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:beta2:*:*:*:*:*:*",
"matchCriteriaId": "CE71E13C-0DDE-46ED-99E1-0D71E6539EE9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:beta2.1:*:*:*:*:*:*",
"matchCriteriaId": "E54A4CD9-AB69-4DF9-AA3A-0C3A0532FF15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:beta3:*:*:*:*:*:*",
"matchCriteriaId": "D6BDF574-AD5F-44AB-95AB-1790E4563977",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:beta3.1:*:*:*:*:*:*",
"matchCriteriaId": "62B1D7AB-039A-4496-A55C-6BFCFC40BD37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:beta4:*:*:*:*:*:*",
"matchCriteriaId": "804FC715-BF72-4E2D-8129-6E499E3F48F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B4B5EA47-4175-4E39-A2E8-66CF592DFA48",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "3DE1E832-43E7-4650-9F48-FDEEB75C1B93",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "FEEDEDCF-E956-4F2E-B13D-9E63DF6B31AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:rc4:*:*:*:*:*:*",
"matchCriteriaId": "5582EEF9-33A8-42C0-A2BF-E0A1EA431187",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the EditNews function in ManageNews.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, might allow remote authenticated users to inject arbitrary web script or HTML via a save_items action."
},
{
"lang": "es",
"value": "Vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en la funci\u00f3n EditNews en ManageNews.php de Simple Machines Forum antes de v1.1.13 y v2.x antes de 2.0 RC5 , permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s de la acci\u00f3n save_items.\r\n"
}
],
"id": "CVE-2011-1129",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2011-06-21T02:52:42.390",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.openwall.com/lists/oss-security/2011/02/22/17"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.openwall.com/lists/oss-security/2011/03/02/4"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.simplemachines.org/community/index.php?topic=421547.0"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.openwall.com/lists/oss-security/2011/02/22/17"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.openwall.com/lists/oss-security/2011/03/02/4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.simplemachines.org/community/index.php?topic=421547.0"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-10-24 17:55
Modified
2025-04-11 00:51
Severity ?
Summary
Multiple SQL injection vulnerabilities in Simple Machines Forum (SMF) before 1.1.15 and 2.x before 2.0.1 allow remote attackers to execute arbitrary SQL commands via vectors involving a (1) HTML entity or (2) display name. NOTE: some of these details are obtained from third party information.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:simplemachines:smf:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F171B1A4-FA42-42B5-BAF7-857A41D575EC",
"versionEndIncluding": "1.1.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7A85D503-FACF-4814-8E67-E6EEE93FB23D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0:beta4:*:*:*:*:*:*",
"matchCriteriaId": "C8BA3B1D-A1F6-419B-9944-AF01B785C626",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0:beta4.1:*:*:*:*:*:*",
"matchCriteriaId": "6B164981-7F13-43B3-BA29-4F4D52EAC466",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0:beta5:*:*:*:*:*:*",
"matchCriteriaId": "838FA5D8-79E6-4B42-BC0A-51FEA2515442",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0:beta6:*:*:*:*:*:*",
"matchCriteriaId": "C7CC60C4-EED4-41AA-A5DF-5332E6D66E80",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B9F73B7F-8FF3-4A13-943D-C6BF353A5296",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "63FA8C3A-ACF7-4C97-9380-9E144FDF7DF9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8E019CBA-7837-4260-8A86-559C483E405C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9AD93454-C8FA-4966-96D1-AA7DFA0D3C47",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "07D1D8AB-9927-41D5-A81B-B035B661D7E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "543D57E7-B3D0-4714-B5FB-336A1627E1A8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "6FECEABB-BE07-412B-9A08-EAC79A5215D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "2A55E760-7CD8-4590-86B9-11ACA1202A23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "1397297A-7087-42AD-B3D6-1DAA71D3E6DB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "A5F0958C-8FC7-44B2-819D-6688A7D40632",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "A454C424-E1CD-46A4-A9AC-12BB22400D64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "732474E6-B87C-4AFA-9868-3559634A688D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "A3F625DB-65E9-41FB-B733-CC4AEF1B9895",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.13:*:*:*:*:*:*:*",
"matchCriteriaId": "DD622FF4-C724-4D50-9712-5E632F3E83CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.14:*:*:*:*:*:*:*",
"matchCriteriaId": "D01CD63D-16B7-4D98-9E67-CF0838A65FFF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.15:*:*:*:*:*:*:*",
"matchCriteriaId": "46A72FB0-88A3-4E2E-B34C-E51EE91A51E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.16:*:*:*:*:*:*:*",
"matchCriteriaId": "79296012-575A-42EC-9E9A-4549346D7475",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.17:*:*:*:*:*:*:*",
"matchCriteriaId": "25089E42-354D-4A0C-8845-01F6800446D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.18:*:*:*:*:*:*:*",
"matchCriteriaId": "60A992F6-5BD0-458B-A813-6EA539249FAA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.19:*:*:*:*:*:*:*",
"matchCriteriaId": "A8C8198A-38C0-481A-BDBE-D193E69C5462",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.20:*:*:*:*:*:*:*",
"matchCriteriaId": "95AE6F3E-1B4C-425B-8B9C-DD32B534F234",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.0.21:*:*:*:*:*:*:*",
"matchCriteriaId": "71405233-0271-4081-B082-208A74B2E8B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "682BE6FC-F9FC-4C90-A56B-EC05B518C55F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:beta1:*:*:*:*:*:*",
"matchCriteriaId": "7122D896-354C-4E62-B507-1898DEC6F00E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:beta2:*:*:*:*:*:*",
"matchCriteriaId": "17C92F5C-C1C9-4D05-B096-755CC6DFAA51",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:beta3:*:*:*:*:*:*",
"matchCriteriaId": "268C6140-13DE-43F2-958D-7882AC342E2C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:beta4:*:*:*:*:*:*",
"matchCriteriaId": "755E8504-6C4A-467A-835B-222EEB77CE8F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "EB5AF099-0B41-48C6-810E-A4AF7B3EB646",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "4CFE75DC-93E1-487B-B50C-1465A98956AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1:rc3:*:*:*:*:*:*",
"matchCriteriaId": "920956A5-C343-4FCF-9BF3-F4E8C79F9993",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1539E360-712B-4DF1-813C-82F87C0946FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2530C440-9C8C-4966-88B0-176D8FEBDFB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "565A8842-9B1E-4764-85E2-021F7825A1CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "603B3808-FDFF-432E-8937-984897377BB8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B5656FF9-3F20-476C-A3F7-69EED049E669",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "5187CA56-26DD-4042-82DC-FCD0CB8A84FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "DB527C06-DEAB-416D-ABBD-F0A7F33F91D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "4A8C2083-53A9-4E71-A268-D8690A288F8A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.9:*:*:*:*:*:*:*",
"matchCriteriaId": "0127EAC8-B363-4262-B80E-FF7415701038",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.10:*:*:*:*:*:*:*",
"matchCriteriaId": "D6FEC752-D94D-4D0D-BC96-82654F69144D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.11:*:*:*:*:*:*:*",
"matchCriteriaId": "E5188CC8-45B8-4A07-B474-6B92C7F15276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.12:*:*:*:*:*:*:*",
"matchCriteriaId": "C8B91D95-8F28-4D12-9953-5DE092654009",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:1.1.13:*:*:*:*:*:*:*",
"matchCriteriaId": "6809AA5E-49CE-456B-AD18-065154A61ECB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9CB71788-5E98-41F4-A49B-B1481DB2AAD5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "AFBA92BD-F323-4786-A31E-E01642CFD415",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:beta2:*:*:*:*:*:*",
"matchCriteriaId": "CE71E13C-0DDE-46ED-99E1-0D71E6539EE9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:beta2.1:*:*:*:*:*:*",
"matchCriteriaId": "E54A4CD9-AB69-4DF9-AA3A-0C3A0532FF15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:beta3:*:*:*:*:*:*",
"matchCriteriaId": "D6BDF574-AD5F-44AB-95AB-1790E4563977",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:beta3.1:*:*:*:*:*:*",
"matchCriteriaId": "62B1D7AB-039A-4496-A55C-6BFCFC40BD37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:beta4:*:*:*:*:*:*",
"matchCriteriaId": "804FC715-BF72-4E2D-8129-6E499E3F48F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B4B5EA47-4175-4E39-A2E8-66CF592DFA48",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:rc1.2:*:*:*:*:*:*",
"matchCriteriaId": "B37BDC8B-C00C-4443-A1DD-C1823E064940",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "3DE1E832-43E7-4650-9F48-FDEEB75C1B93",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "FEEDEDCF-E956-4F2E-B13D-9E63DF6B31AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:rc4:*:*:*:*:*:*",
"matchCriteriaId": "5582EEF9-33A8-42C0-A2BF-E0A1EA431187",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:rc5:*:*:*:*:*:*",
"matchCriteriaId": "4F0ADA12-A87E-44EE-80FC-E15C244A2F57",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple SQL injection vulnerabilities in Simple Machines Forum (SMF) before 1.1.15 and 2.x before 2.0.1 allow remote attackers to execute arbitrary SQL commands via vectors involving a (1) HTML entity or (2) display name. NOTE: some of these details are obtained from third party information."
},
{
"lang": "es",
"value": "Multiples vulnerabilidades de inyecci\u00f3n SQL en Simple Machines Forum (SMF) anterios a v1.1.15 y v2.x anteriores a 2.0.1 que permiten a atacantes remotos ejecutar comandos SQL de su elecci\u00f3n a traves de vectores que incluyen una (1) entidad HTML o (2) muestran nombre. NOTA: algunos de estos detalles han sido obtenidos a partir de la informaci\u00f3n de terceros."
}
],
"evaluatorSolution": "Per: http://secunia.com/advisories/46386\r\n\r\n\u0027Solution Update to version 1.1.15 or version 2.0.1.\u0027",
"id": "CVE-2011-3615",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2011-10-24T17:55:03.220",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://openwall.com/lists/oss-security/2011/10/09/3"
},
{
"source": "secalert@redhat.com",
"url": "http://openwall.com/lists/oss-security/2011/10/10/6"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/46386"
},
{
"source": "secalert@redhat.com",
"url": "http://www.simplemachines.org/community/index.php?topic=452888.0"
},
{
"source": "secalert@redhat.com",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/70617"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://openwall.com/lists/oss-security/2011/10/09/3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://openwall.com/lists/oss-security/2011/10/10/6"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/46386"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.simplemachines.org/community/index.php?topic=452888.0"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/70617"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-10-24 18:55
Modified
2025-04-11 00:51
Severity ?
Summary
Cross-site request forgery (CSRF) vulnerability in Simple Machines Forum (SMF) 2.x before 2.0.1 allows remote attackers to hijack the authentication of administrators or moderators via vectors involving image files, a different vulnerability than CVE-2011-3615. NOTE: some of these details are obtained from third party information.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| simplemachines | smf | 2.0 | |
| simplemachines | smf | 2.0 | |
| simplemachines | smf | 2.0 | |
| simplemachines | smf | 2.0 | |
| simplemachines | smf | 2.0 | |
| simplemachines | smf | 2.0 | |
| simplemachines | smf | 2.0 | |
| simplemachines | smf | 2.0 | |
| simplemachines | smf | 2.0 | |
| simplemachines | smf | 2.0 | |
| simplemachines | smf | 2.0 | |
| simplemachines | smf | 2.0 | |
| simplemachines | smf | 2.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9CB71788-5E98-41F4-A49B-B1481DB2AAD5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "AFBA92BD-F323-4786-A31E-E01642CFD415",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:beta2:*:*:*:*:*:*",
"matchCriteriaId": "CE71E13C-0DDE-46ED-99E1-0D71E6539EE9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:beta2.1:*:*:*:*:*:*",
"matchCriteriaId": "E54A4CD9-AB69-4DF9-AA3A-0C3A0532FF15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:beta3:*:*:*:*:*:*",
"matchCriteriaId": "D6BDF574-AD5F-44AB-95AB-1790E4563977",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:beta3.1:*:*:*:*:*:*",
"matchCriteriaId": "62B1D7AB-039A-4496-A55C-6BFCFC40BD37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:beta4:*:*:*:*:*:*",
"matchCriteriaId": "804FC715-BF72-4E2D-8129-6E499E3F48F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B4B5EA47-4175-4E39-A2E8-66CF592DFA48",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:rc1.2:*:*:*:*:*:*",
"matchCriteriaId": "B37BDC8B-C00C-4443-A1DD-C1823E064940",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "3DE1E832-43E7-4650-9F48-FDEEB75C1B93",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "FEEDEDCF-E956-4F2E-B13D-9E63DF6B31AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:rc4:*:*:*:*:*:*",
"matchCriteriaId": "5582EEF9-33A8-42C0-A2BF-E0A1EA431187",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:simplemachines:smf:2.0:rc5:*:*:*:*:*:*",
"matchCriteriaId": "4F0ADA12-A87E-44EE-80FC-E15C244A2F57",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability in Simple Machines Forum (SMF) 2.x before 2.0.1 allows remote attackers to hijack the authentication of administrators or moderators via vectors involving image files, a different vulnerability than CVE-2011-3615. NOTE: some of these details are obtained from third party information."
},
{
"lang": "es",
"value": "Vulnerabilidad de falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF)en Simple Machines Forum (SMF) v2.x anterior a v2.0.1 permite a atacantes remotos secuestrar la autenticaci\u00f3n de administradores o moderadores a trav\u00e9s de vectores que envuelven ficheros con im\u00e1genes, una vulnerabilidad diferente que CVE-2011-3615. NOTA: algunos de estos detalles han sido obtenidos de terceras partes de informaci\u00f3n."
}
],
"id": "CVE-2011-4173",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2011-10-24T18:55:02.423",
"references": [
{
"source": "cve@mitre.org",
"url": "http://openwall.com/lists/oss-security/2011/10/09/3"
},
{
"source": "cve@mitre.org",
"url": "http://openwall.com/lists/oss-security/2011/10/10/6"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/46386"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.simplemachines.org/community/index.php?topic=452888.0"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://openwall.com/lists/oss-security/2011/10/09/3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://openwall.com/lists/oss-security/2011/10/10/6"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/46386"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.simplemachines.org/community/index.php?topic=452888.0"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}