Vulnerability CVE-2011-1130
Published: 2011-06-20   Modified: 2012-02-13

Description:
Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, does not properly validate the start parameter, which might allow remote attackers to conduct SQL injection attacks, obtain sensitive information, or cause a denial of service via a crafted value, related to the cleanRequest function in QueryString.php and the constructPageIndex function in Subs.php.

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Simplemachines -> SMF 

 References:
http://www.simplemachines.org/community/index.php?topic=421547.0
http://www.openwall.com/lists/oss-security/2011/03/02/4
http://www.openwall.com/lists/oss-security/2011/02/22/17
http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip
Copyright 2024, cxsecurity.com

 

Back to Top