eFiction 3.1.1 - 'path_to_smf' Remote File Inclusion

To ConTacT mE @ www.Asb-May.net/bb ScRiPt:-http://www.efiction.org/downloads/eFiction31.zip GrEaTz To:-ToOofa-HaCk.eGy All AsB-MaY DisCoverY ExPloIts GrOup Discovered By:- ThE dE@Th logout.php:- includeonce$pathtosmf."Sources/Subs-Auth.php"; getsessionvars.php:- requireonce$pathtosmf."SSI.php";...

CVE-2006-7013

CVE-2006-7013 affects Simple Machines Forum (SMF) versions 1.0.7 and earlier and 1.1rc2 and earlier. The issue lets remote attackers spoof the user IP and evade bans by manipulating the X-Forwarded-For header, which is treated as the IP source instead of more reliable sources. The root cause is r...

CVE-2007-0399

Multiple cross-site scripting XSS vulnerabilities in index.php in Simple Machines Forum SMF 1.1 RC3 allow remote authenticated users to inject arbitrary web script or HTML via the 1 recipient or 2 BCC field when selecting send in a pm action...

CVE-2007-0399

SMF 1.1 RC3 exposes multiple XSS flaws in index.php during the PM “send” action. Infected input (recipient/BCC fields) can inject arbitrary script/HTML in the context of an authenticated user. Affected: Simple Machines Forum (SMF), version 1.1 RC3; vulnerability arises in the PM sending workflow....

CVE-2007-0399

Multiple cross-site scripting XSS vulnerabilities in index.php in Simple Machines Forum SMF 1.1 RC3 allow remote authenticated users to inject arbitrary web script or HTML via the 1 recipient or 2 BCC field when selecting send in a pm action...

SMF "index.php?action=pm" Cross Site-Scripting

Aria-Security Team http://Aria-Security.com Type:Remote Cross-Site Scripting Article on XSS: http://aria-security.net/xss.rar Discovered By Aria-Security Team Tested on SMF 1.1 RC3 Explanation: -First of all user must be REGISTERED -Go to http://target/smf/index.php?action=pm;sa=send -Inster your...

SMF 1.1 - index.php HTML Injection

SMF 1.1 - index.php HTML Injection source: https://www.securityfocus.com/bid/22143/info SMF is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script code would execute ...

SMF 1.1 - 'index.php' HTML Injection

source: https://www.securityfocus.com/bid/22143/info SMF is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script code would execute in the context of the affected...

CVE-2006-6375

Cross-site scripting XSS vulnerability in display.php in Simple Machines Forum SMF 1.1 Final and earlier allows remote attackers to inject arbitrary web script or HTML via the contents of a file that is uploaded with the image parameter set, which can be interpreted as script by Internet Explorer...

CVE-2006-6375

CVE-2006-6375 is a cross-site scripting (XSS) flaw in display.php of Simple Machines Forum (SMF) 1.1 Final and earlier. The vulnerability allows remote attackers to inject arbitrary script/HTML via the contents of a file uploaded with the image parameter, which can be interpreted as script by Int...

CVE-2006-5504

Cross-site scripting XSS vulnerability in index.php in Simple Machines Forum SMF allows remote attackers to inject arbitrary web script or HTML via a base64 encoded params value in the action parameter...

CVE-2006-5503

Cross-site scripting XSS vulnerability in index.php in Simple Machines Forum SMF 1.1 RC2 allows remote attackers to inject arbitrary web script or HTML via the action parameter...

CVE-2006-5504

Cross-site scripting XSS vulnerability in index.php in Simple Machines Forum SMF allows remote attackers to inject arbitrary web script or HTML via a base64 encoded params value in the action parameter...

CVE-2006-5503

The provided data confirms a Cross-site scripting (XSS) vulnerability in Simple Machines Forum (SMF) 1.1 RC2 . The issue occurs in the file indicated by the description (likely index.php) where an attacker can inject arbitrary script/HTML via the action parameter , enabling remote script executio...

CVE-2006-5504

CVE-2006-5504 affects Simple Machines Forum (SMF). The vulnerability is a Cross-site Scripting (XSS) in index.php where an attacker can inject arbitrary web script or HTML by supplying a base64-encoded value in the action parameter. Impact is described as partial integrity impact on the target. T...

SMF-xss.txt

title: Simple Machines Forum SMF XSS issue author: Jose Carlos Norte discovered by: Jose Carlos Norte 1. introduction Simple machines forum is a popular scalable free bulletin board system written in php over mysql database, the url of the project: http://www.simplemachines.org/ 2. XSS problem SM...

Simple Machines Forum (SMF) XSS issue

title: Simple Machines Forum SMF XSS issue author: Jose Carlos Norte discovered by: Jose Carlos Norte 1. introduction Simple machines forum is a popular scalable free bulletin board system written in php over mysql database, the url of the project: http://www.simplemachines.org/ 2. XSS problem SM...

Simple Machines Forum (SMF) 1.0/1.1 - 'index.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/20629/info Simple Machines Forum is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code execute in the browser of an...

Simple Machines Forum (SMF) 1.01.1 - index.php Cross-Site Scripting

Simple Machines Forum SMF 1.01.1 - index.php Cross-Site Scripting source: https://www.securityfocus.com/bid/20629/info Simple Machines Forum is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue...

CVE-2006-4564

CVE-2006-4564 describes an SQL injection vulnerability in Simple Machines Forum (SMF) 1.1 RC3, occurring in Sources/ManageBoards.php. The vulnerability is exploitable via the cur_cat parameter, enabling remote attackers to execute arbitrary SQL commands. The CVSS v2 base score is 5.1 (Medium) wit...