CVE-2016-5726 Packages.php in Simple Machines Forum (SMF) 2.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the themechanges array parameter.
CriticalCVSS 9.8
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Packages.php in Simple Machines Forum (SMF) 2.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the themechanges array parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| simplemachines simple machines forum | = 2.1 | No fix listed |
References
- [oss-security] 20160610 Simple Machines Forums - PHP Object Injection mailing-list patch third-party-advisory
- [oss-security] 20160618 Re: Simple Machines Forums - PHP Object Injection mailing-list patch third-party-advisory