Samker's Computer Forum - SCforum.info
World TOP Headlines: => Latest Security News & Alerts => Topic started by: Pez on 09. March 2016., 01:13:01
-
Simple Machines Forum Multiple Security Vulnerabilities
This is not totaly new but from about 2015-03-25.
Summary
Simple Machines Forum is prone to multiple security vulnerabilities: - A remote PHP code-execution vulnerability - Multiple cross-site scripting vulnerabilities - Multiple cross-site request-forgery vulnerabilities - An information-disclosure vulnerability - Multiple denial-of-service vulnerabilities Attackers can exploit these issues to execute arbitrary script code within the context of the webserver, perform unauthorized actions on behalf of legitimate users, compromise the affected application, steal cookie-based authentication credentials, obtain information that could aid in further attacks or cause denial-of-service conditions. Please note some of these issues may already be described in other BIDs. This BID will be updated if further analysis confirms this. These issues affect Simple Machines Forum 2.0 RC2. Some of these issues also affect version 1.1.10.
Solution
Reportedly, the vendor fixed some of the issues in the release 1.1.11.
References
• http://code.google.com/p/smf2-review/issues/list (http://code.google.com/p/smf2-review/issues/list)
• http://www.securityfocus.com/bid/37182 (http://www.securityfocus.com/bid/37182)
• http://www.simplemachines.org/ (http://www.simplemachines.org/)