HIGH🇵🇱 Wersja polska

CVE-2009-5068

CVSS 7.2v3.1pub. 2020-01-15upd. 2024-11-21

There is a file disclosure vulnerability in SMF (Simple Machines Forum) affecting versions through v2.0.3. On some configurations a SMF deployment is shared by several "co-admins" that are not trusted beyond the SMF deployment. This vulnerability allows them to read arbitrary files on the filesystem and therefore gain new privileges by reading the settings.php with the database passwords.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

  • Simplemachines Simple Machines Forum

    APP
    Simplemachines
    ≤ 2.0.3
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2018-10305CRITICAL9.8PL ✓same product

SMF: obejście kontroli dostępu w wyszukiwaniu prywatnych wiadomości

CVE-2016-5726CRITICAL9.8PL ✓same product

PHP Object Injection w Simple Machines Forum 2.1 — zdalne wykonanie kodu

CVE-2022-26982HIGH7.2same product

SimpleMachinesForum 2.1.1 and earlier allows remote authenticated administrators to execute arbitrary code by ...

CVE-2013-7466HIGH8.8same product

Simple Machines Forum (SMF) 2.0.4 allows local file inclusion, with resultant remote code execution, in instal...

CVE-2013-7468HIGH8.1same product

Simple Machines Forum (SMF) 2.0.4 allows PHP Code Injection via the index.php?action=admin;area=languages;sa=e...