Simple Machine Forum - Private section/posts/info disclosure

2007-11-08T00:00:00
ID SECURITYVULNS:DOC:18374
Type securityvulns
Reporter Securityvulns
Modified 2007-11-08T00:00:00

Description

Vulnerable: Simple Machine Forum [ALL Versions]

Tested on SMF 1.1.4

Type: Private Section,Posts,Information disclosure.

Risk: Low / Medium

Discovered By Seph1roth

Site: http://www.blackroots.it -> The Best Hacking site. (eng / ita)

Explanation:

If some section is rescricted only for staff,vips or private groups/members,this bug can be used for

read entire section and message, without privileges.

Example:

In my forum i've a Staff area , and into that , there is a message that contain Bug,exploit or some

others keywords...i'll put in the advanced search module # this keywords ,and i select "show results as messages"...and tadaaa...my priv8 zone can be read by everyone...

Greetz to all BlackRoots users!

Shoutz to all kiddies!