Simple Machines Forum User Impersonation and Clickjacking Vulnerabilities
BID:64349
Info
Simple Machines Forum User Impersonation and Clickjacking Vulnerabilities
| Bugtraq ID: | 64349 |
| Class: | Input Validation Error |
| CVE: |
CVE-2013-7234 CVE-2013-7235 CVE-2013-7236 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 13 2013 12:00AM |
| Updated: | Dec 31 2013 12:49AM |
| Credit: | Jakob Lell |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
Simple Machines Forum User Impersonation and Clickjacking Vulnerabilities
Simple Machines Forum is prone to multiple user-impersonation vulnerabilities and a clickjacking vulnerability.
Attackers can exploit these issues to impersonate arbitrary users, compromise the affected application or obtain sensitive information. Other attacks are also possible.
Versions prior to Simple Machines Forum 1.1.19 and 2.0.6 are vulnerable.
Simple Machines Forum is prone to multiple user-impersonation vulnerabilities and a clickjacking vulnerability.
Attackers can exploit these issues to impersonate arbitrary users, compromise the affected application or obtain sensitive information. Other attacks are also possible.
Versions prior to Simple Machines Forum 1.1.19 and 2.0.6 are vulnerable.
Exploit / POC
Simple Machines Forum User Impersonation and Clickjacking Vulnerabilities
An attacker can use a web browser to exploit these issues.
An attacker can use a web browser to exploit these issues.
Solution / Fix
Simple Machines Forum User Impersonation and Clickjacking Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Simple Machines Forum User Impersonation and Clickjacking Vulnerabilities
References:
References:
- Simple Machines Homepage (Simple Machines)