Vulnerability CVE-2022-26982
Published: 2022-04-05

Description:
SimpleMachinesForum 2.1.1 and earlier allows remote authenticated administrators to execute arbitrary code by inserting a vulnerable php code because the themes can be modified by an administrator.

See advisories in our WLB2 database:
Topic
Author
Date
Med.
Remote Code Execution in SimpleMachinesForum 2.1.1
Sarang Tumne
18.11.2022

Type:

CWE-732

CVSS2 => (AV:N/AC:L/Au:S/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.5/10
6.4/10
8/10
Exploit range
Attack complexity
Authentication
Remote
Low
Single time
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Simplemachines -> Simple machines forum 

 References:
https://github.com/sartlabs/0days/blob/main/SimpleMachinesForum/Exploit.txt
Copyright 2024, cxsecurity.com

 

Back to Top