CVE-2008-6658 Directory traversal vulnerability in index.php in Simple Machines Forum (SMF) 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote authenticated administrators to install packages from arbitrary direc...
MediumCVSS 4.0
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Directory traversal vulnerability in index.php in Simple Machines Forum (SMF) 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote authenticated administrators to install packages from arbitrary directories via a .. (dot dot) in the package parameter during an install2 action, as demonstrated by a predictable package filename in attachments/ that was uploaded through a post2 action to index.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| simple machines forum | = 1.0.5 | No fix listed |
| simple machines forum | = 1.0.6 | No fix listed |
| simple machines forum | = 1.0.7 | No fix listed |
| simple machines forum | = 1.0.11 | No fix listed |
| simple machines forum | = 1.0.12 | No fix listed |
| simple machines forum | = 1.1.1 | No fix listed |
| simple machines forum | = 1.1.2 | No fix listed |
| simple machines forum | = 1.1.3 | No fix listed |
| simple machines forum | = 1.1.4 | No fix listed |
| simple machines forum | = 1.1.5 | No fix listed |
| simple machines forum | = 1.1.6 | No fix listed |
| simple machines forum | = 1.1_rc1 | No fix listed |
| simple machines forum | = 1.1_rc2 | No fix listed |
| simple machines forum | = 1.1_rc3 | No fix listed |
References
- 50070 vdb-entry
- www.simplemachines.org vendor-advisory
- 6993 exploit