CVE-2008-6657 Cross-site request forgery (CSRF) vulnerability in index.php in Simple Machines Forum (SMF) 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote attackers to hijack the authentication of admins for re...
MediumCVSS 6.8
EPSS 1.1%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site request forgery (CSRF) vulnerability in index.php in Simple Machines Forum (SMF) 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote attackers to hijack the authentication of admins for requests that install packages via the package parameter in an install2 action.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| simple machines forum | = 1.0.5 | No fix listed |
| simple machines forum | = 1.0.6 | No fix listed |
| simple machines forum | = 1.0.7 | No fix listed |
| simple machines forum | = 1.0.11 | No fix listed |
| simple machines forum | = 1.0.12 | No fix listed |
| simple machines forum | = 1.1.1 | No fix listed |
| simple machines forum | = 1.1.2 | No fix listed |
| simple machines forum | = 1.1.3 | No fix listed |
| simple machines forum | = 1.1.4 | No fix listed |
| simple machines forum | = 1.1.5 | No fix listed |
| simple machines forum | = 1.1.6 | No fix listed |
| simple machines forum | = 1.1_rc1 | No fix listed |
| simple machines forum | = 1.1_rc2 | No fix listed |
| simple machines forum | = 1.1_rc3 | No fix listed |
References
- 50071 vdb-entry
- 32516 third-party-advisory vendor-advisory
- 32119 exploit vdb-entry
- www.simplemachines.org vendor-advisory
- smf-unspecified-csrf(46343) vdb-entry
- 6993 exploit