medium4.0Public exploit code
CVE-2008-6658
Directory traversal vulnerability in index.php in Simple Machines Forum (SMF) 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote authenticated administrators…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Simple Machines Forum (SMF) 1.1.6 - Code Execution2008-11-04 · webapps · php · Verified
Impact
Directory traversal vulnerability in index.php in Simple Machines Forum (SMF) 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote authenticated administrators to install packages from arbitrary directories via a .. (dot dot) in the package parameter during an install2 action, as demonstrated by a predictable package filename in attachments/ that was uploaded through a post2 action to index.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Simple Machines | Simple Machines Forum | Versions 1.0.5, 1.0.6, 1.0.7, 1.0.11, 1.0.12, 1.1.1 |