CVE-2016-5727 LogInOut.php in Simple Machines Forum (SMF) 2.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via vectors related to variables derived from user input....
HighCVSS 8.8
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
LogInOut.php in Simple Machines Forum (SMF) 2.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via vectors related to variables derived from user input in a foreach loop.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| simplemachines simple machines forum | = 2.1 | No fix listed |
References
- [oss-security] 20160610 Simple Machines Forums - PHP Object Injection mailing-list patch third-party-advisory
- [oss-security] 20160618 Re: Simple Machines Forums - PHP Object Injection mailing-list patch third-party-advisory
- github.com issue-tracking patch third-party-advisory
- github.com issue-tracking patch third-party-advisory