SMF 'index.php' HTML injection and Multiple PHP Code Injection Vulnerabilities

Bugtraq ID:	59409
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 23 2013 12:00AM
Updated:	Aug 26 2013 12:21AM
Credit:	Jakub Galczyk
Vulnerable:
Not Vulnerable:

SMF 'index.php' HTML injection and Multiple PHP Code Injection Vulnerabilities

SMF is prone to an HTML-injection and multiple PHP code-injection vulnerabilities.

An attacker may leverage these issues to execute arbitrary server-side script code on an affected computer with the privileges of the affected application and inject hostile HTML and script code into vulnerable sections of the application.

SMF 2.0.4 is vulnerable; other versions may also be affected.

SMF 'index.php' HTML injection and Multiple PHP Code Injection Vulnerabilities

Attackers can exploit these issues through a browser.

The following proof-of-concept is available:

• /data/vulnerabilities/exploits/59409.php.txt

SMF 'index.php' HTML injection and Multiple PHP Code Injection Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

SMF 'index.php' HTML injection and Multiple PHP Code Injection Vulnerabilities

References:

• Simple Machines SMF Homepage (Simple Machines)