CVE-2008-6657

Cross-site request forgery (CSRF) vulnerability in index.php in Simple Machines Forum (SMF) 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote attackers to hijack the authentication of admins for requests that install packages via the package parameter in an install2 action.

Link	Resource
http://secunia.com/advisories/32516	Vendor Advisory
http://osvdb.org/50071
http://www.simplemachines.org/community/index.php?topic=272861.0	Vendor Advisory
http://www.securityfocus.com/bid/32119	Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/46343
https://www.exploit-db.com/exploits/6993

Configuration 1

cpe:2.3:a:simple_machines:simple_machines_forum:1.0.11:*:*:*:*:*:*:* cpe:2.3:a:simple_machines:simple_machines_forum:1.1.5:*:*:*:*:*:*:* cpe:2.3:a:simple_machines:simple_machines_forum:1.1.1:*:*:*:*:*:*:* cpe:2.3:a:simple_machines:simple_machines_forum:1.0.7:*:*:*:*:*:*:* cpe:2.3:a:simple_machines:simple_machines_forum:1.1.4:*:*:*:*:*:*:* cpe:2.3:a:simple_machines:simple_machines_forum:1.1_rc1:*:*:*:*:*:*:* cpe:2.3:a:simple_machines:simple_machines_forum:1.0.5:*:*:*:*:*:*:* cpe:2.3:a:simple_machines:simple_machines_forum:1.1.6:*:*:*:*:*:*:* cpe:2.3:a:simple_machines:simple_machines_forum:1.1_rc3:*:*:*:*:*:*:* cpe:2.3:a:simple_machines:simple_machines_forum:1.1_rc2:*:*:*:*:*:*:* cpe:2.3:a:simple_machines:simple_machines_forum:1.1.3:*:*:*:*:*:*:* cpe:2.3:a:simple_machines:simple_machines_forum:1.0.6:*:*:*:*:*:*:* cpe:2.3:a:simple_machines:simple_machines_forum:1.1.2:*:*:*:*:*:*:* cpe:2.3:a:simple_machines:simple_machines_forum:1.0.12:*:*:*:*:*:*:*

---

Published : 2009-04-07 07:30

Updated : 2017-09-29 01:33

---

NVD link : CVE-2008-6657

Mitre link : CVE-2008-6657

Simple Machines

CWE-352