Sql injection

SQL injection vulnerability in the awardsMembers function in Sources/Profile.php in the Member Awards component 1.0.2 for Simple Machines Forum SMF allows remote attackers to execute arbitrary SQL commands via the id parameter in a profile action to index.php. NOTE: some of these details are...

CVE-2009-2385

CVE-2009-2385 affects Simple Machines Forum (SMF) — Member Awards component 1.0.2. The vulnerability lies in the awardsMembers function in Sources/Profile.php, where the id parameter in a profile action to index.php can be exploited to perform SQL injection and execute arbitrary SQL commands. Thi...

CVE-2009-2385

SQL injection vulnerability in the awardsMembers function in Sources/Profile.php in the Member Awards component 1.0.2 for Simple Machines Forum SMF allows remote attackers to execute arbitrary SQL commands via the id parameter in a profile action to index.php. NOTE: some of these details are...

Simple Machines Forum (SMF) <= 1.1.4 SQLi Vulnerability

Simple Machines Forum SMF is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Simple Machines Forum Multiple Vulnerabilities

This host has Simple Machines Forum installed which is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: gbsimplemachinesforummultvulnapr09.nasl 4869 2016-12-29 11:01:45Z teissa $ Simple Machines Forum Multiple Vulnerabilities. Authors: Nikita MR Copyright: Copyright c 2009...

Simple Machines Forum (SMF) Detection (HTTP)

HTTP based detection of Simple Machines Forum SMF. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2008-6741

SQL injection vulnerability in Load.php in Simple Machines Forum SMF 1.1.4 and earlier allows remote attackers to execute arbitrary SQL commands by setting the dbcharacterset parameter to a multibyte character set such as big5, which causes the addslashes PHP function to produce a "" backslash...

CVE-2008-6741

SQL injection vulnerability in Load.php in Simple Machines Forum SMF 1.1.4 and earlier allows remote attackers to execute arbitrary SQL commands by setting the dbcharacterset parameter to a multibyte character set such as big5, which causes the addslashes PHP function to produce a "" backslash...

Directory traversal

Directory traversal vulnerability in index.php in Simple Machines Forum SMF 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote authenticated administrators to install packages from arbitrary directories via a .. dot dot in the package parameter during an install2 action, as demonstrated by a...

CVE-2008-6657

Cross-site request forgery CSRF vulnerability in index.php in Simple Machines Forum SMF 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote attackers to hijack the authentication of admins for requests that install packages via the package parameter in an install2 action...

CVE-2008-6658

Directory traversal vulnerability in index.php in Simple Machines Forum SMF 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote authenticated administrators to install packages from arbitrary directories via a .. dot dot in the package parameter during an install2 action, as demonstrated by a...

CVE-2008-6659

Directory traversal vulnerability in index.php in Simple Machines Forum SMF 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote authenticated users to configure arbitrary local files for execution via directory traversal sequences in the value of the themedir field during a jsoption action,...

Directory traversal

Directory traversal vulnerability in index.php in Simple Machines Forum SMF 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote authenticated users to configure arbitrary local files for execution via directory traversal sequences in the value of the themedir field during a jsoption action,...

CVE-2008-6657

SMF 1.x is affected by a CSRF vulnerability in index.php. Versions 1.0 before 1.0.15 and 1.1 before 1.1.7 allow remote attackers to hijack admin authentication for install2 package requests. Impact is admin-level session hijack via crafted requests; exploitation requires no user interaction. The ...

CVE-2008-6657

Cross-site request forgery CSRF vulnerability in index.php in Simple Machines Forum SMF 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote attackers to hijack the authentication of admins for requests that install packages via the package parameter in an install2 action...

CVE-2008-6658

Directory traversal vulnerability in index.php in Simple Machines Forum SMF 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote authenticated administrators to install packages from arbitrary directories via a .. dot dot in the package parameter during an install2 action, as demonstrated by a...

CVE-2008-6659

Directory traversal vulnerability in index.php in Simple Machines Forum SMF 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote authenticated users to configure arbitrary local files for execution via directory traversal sequences in the value of the themedir field during a jsoption action,...

CVE-2008-6544

Multiple PHP remote file inclusion vulnerabilities in Simple Machines Forum SMF 1.1.4 allow remote attackers to execute arbitrary PHP code via a URL in the 1 settingsdefaultthemedir parameter to Sources/Subs-Graphics.php and 2 settingsdefaultthemedir parameter to Sources/Themes.php. NOTE: CVE and...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Simple Machines Forum SMF 1.1.4 allow remote attackers to execute arbitrary PHP code via a URL in the 1 settingsdefaultthemedir parameter to Sources/Subs-Graphics.php and 2 settingsdefaultthemedir parameter to Sources/Themes.php. NOTE: CVE and...

CVE-2008-6544

Concretely, CVE-2008-6544 affects Simple Machines Forum (SMF) 1.1.4. The vulnerability is described as PHP remote file inclusion via the settings[default_theme_dir] parameter to two endpoints: Sources/Subs-Graphics.php and Sources/Themes.php. The underlying issue involves allowing a URL to influe...