Search
Find a vulnerability
Search criteria
6 vulnerabilities found for simple_machine_forum by simplemachines
CVE-2024-7437 (GCVE-0-2024-7437)
Vulnerability from nvd – Published: 2024-08-03 14:31 – Updated: 2024-08-10 06:26
VLAI
EPSS
VEX
Title
SimpleMachines SMF Delete User index.php resource injection
Summary
A vulnerability, which was classified as critical, was found in SimpleMachines SMF 2.1.4. Affected is an unknown function of the file /index.php?action=profile;u=2;area=showalerts;do=remove of the component Delete User Handler. The manipulation of the argument aid leads to improper control of resource identifiers. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Severity
5.4 (Medium)
5.4 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-06 14:21 UTC
CWE
- CWE-99 - Improper Control of Resource Identifiers
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.273522 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.273522 | signaturepermissions-required |
| https://vuldb.com/?submit.380189 | third-party-advisory |
| https://github.com/Fewword/Poc/blob/main/smf/smf-… | exploit |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| SimpleMachines | SMF |
Affected:
2.1.4
|
|
| simplemachines | simple_machine_forum |
Affected:
2.1.4
cpe:2.3:a:simplemachines:simple_machine_forum:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:simplemachines:simple_machine_forum:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "simple_machine_forum",
"vendor": "simplemachines",
"versions": [
{
"status": "affected",
"version": "2.1.4"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-7437",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-06T14:21:49.377339Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-06T14:24:08.526Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Delete User Handler"
],
"product": "SMF",
"vendor": "SimpleMachines",
"versions": [
{
"status": "affected",
"version": "2.1.4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Fewwords (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability, which was classified as critical, was found in SimpleMachines SMF 2.1.4. Affected is an unknown function of the file /index.php?action=profile;u=2;area=showalerts;do=remove of the component Delete User Handler. The manipulation of the argument aid leads to improper control of resource identifiers. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used."
},
{
"lang": "de",
"value": "Es wurde eine Schwachstelle in SimpleMachines SMF 2.1.4 gefunden. Sie wurde als kritisch eingestuft. Es geht dabei um eine nicht klar definierte Funktion der Datei /index.php?action=profile;u=2;area=showalerts;do=remove der Komponente Delete User Handler. Durch das Manipulieren des Arguments aid mit unbekannten Daten kann eine improper control of resource identifiers-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.5,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-99",
"description": "CWE-99 Improper Control of Resource Identifiers",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-10T06:26:10.103Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-273522 | SimpleMachines SMF Delete User index.php resource injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.273522"
},
{
"name": "VDB-273522 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.273522"
},
{
"name": "Submit #380189 | SimpleMachines SMF 2.1.4 Insecure Direct Object Reference",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.380189"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/Fewword/Poc/blob/main/smf/smf-poc1.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-08-02T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2024-08-02T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2024-08-10T08:31:03.000Z",
"value": "VulDB entry last update"
}
],
"title": "SimpleMachines SMF Delete User index.php resource injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2024-7437",
"datePublished": "2024-08-03T14:31:04.930Z",
"dateReserved": "2024-08-02T21:22:25.233Z",
"dateUpdated": "2024-08-10T06:26:10.103Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-11574 (GCVE-0-2019-11574)
Vulnerability from nvd – Published: 2020-03-20 22:08 – Updated: 2024-08-04 22:55
VLAI
EPSS
VEX
Summary
An issue was discovered in Simple Machines Forum (SMF) before release 2.0.17. There is SSRF related to Subs-Package.php and Subs.php because user-supplied data is used directly in curl calls.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.simplemachines.org/community/index.ph… | x_refsource_MISC |
| https://pastebin.com/raw/prE3iiLm | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T22:55:40.913Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.simplemachines.org/community/index.php?board=1.0"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://pastebin.com/raw/prE3iiLm"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in Simple Machines Forum (SMF) before release 2.0.17. There is SSRF related to Subs-Package.php and Subs.php because user-supplied data is used directly in curl calls."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-03-20T22:08:06.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.simplemachines.org/community/index.php?board=1.0"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://pastebin.com/raw/prE3iiLm"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-11574",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in Simple Machines Forum (SMF) before release 2.0.17. There is SSRF related to Subs-Package.php and Subs.php because user-supplied data is used directly in curl calls."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.simplemachines.org/community/index.php?board=1.0",
"refsource": "MISC",
"url": "https://www.simplemachines.org/community/index.php?board=1.0"
},
{
"name": "https://pastebin.com/raw/prE3iiLm",
"refsource": "MISC",
"url": "https://pastebin.com/raw/prE3iiLm"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-11574",
"datePublished": "2020-03-20T22:08:06.000Z",
"dateReserved": "2019-04-27T00:00:00.000Z",
"dateUpdated": "2024-08-04T22:55:40.913Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2005-4891 (GCVE-0-2005-4891)
Vulnerability from nvd – Published: 2020-01-15 16:09 – Updated: 2024-08-08 00:01
VLAI
EPSS
VEX
Summary
Simple Machine Forum (SMF) versions 1.0.4 and earlier have an SQL injection vulnerability that allows remote attackers to inject arbitrary SQL statements.
Severity
No CVSS data available.
CWE
- SQL Injection
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://www.openwall.com/lists/oss-security/2012/1… | x_refsource_MISC |
| https://securiteam.com/exploits/5HP0N0KG0O/ | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Simple Machine Forum | Simple Machine Forum |
Affected:
1.0.4 and earlier
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T00:01:23.502Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/11/14/10"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://securiteam.com/exploits/5HP0N0KG0O/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Simple Machine Forum",
"vendor": "Simple Machine Forum",
"versions": [
{
"status": "affected",
"version": "1.0.4 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Simple Machine Forum (SMF) versions 1.0.4 and earlier have an SQL injection vulnerability that allows remote attackers to inject arbitrary SQL statements."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "SQL Injection",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-01-15T16:09:27.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.openwall.com/lists/oss-security/2012/11/14/10"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://securiteam.com/exploits/5HP0N0KG0O/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2005-4891",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Simple Machine Forum",
"version": {
"version_data": [
{
"version_value": "1.0.4 and earlier"
}
]
}
}
]
},
"vendor_name": "Simple Machine Forum"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Simple Machine Forum (SMF) versions 1.0.4 and earlier have an SQL injection vulnerability that allows remote attackers to inject arbitrary SQL statements."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "SQL Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.openwall.com/lists/oss-security/2012/11/14/10",
"refsource": "MISC",
"url": "http://www.openwall.com/lists/oss-security/2012/11/14/10"
},
{
"name": "https://securiteam.com/exploits/5HP0N0KG0O/",
"refsource": "MISC",
"url": "https://securiteam.com/exploits/5HP0N0KG0O/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2005-4891",
"datePublished": "2020-01-15T16:09:27.000Z",
"dateReserved": "2011-12-19T00:00:00.000Z",
"dateUpdated": "2024-08-08T00:01:23.502Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-7437 (GCVE-0-2024-7437)
Vulnerability from cvelistv5 – Published: 2024-08-03 14:31 – Updated: 2024-08-10 06:26
VLAI
EPSS
VEX
Title
SimpleMachines SMF Delete User index.php resource injection
Summary
A vulnerability, which was classified as critical, was found in SimpleMachines SMF 2.1.4. Affected is an unknown function of the file /index.php?action=profile;u=2;area=showalerts;do=remove of the component Delete User Handler. The manipulation of the argument aid leads to improper control of resource identifiers. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Severity
5.4 (Medium)
5.4 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-06 14:21 UTC
CWE
- CWE-99 - Improper Control of Resource Identifiers
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.273522 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.273522 | signaturepermissions-required |
| https://vuldb.com/?submit.380189 | third-party-advisory |
| https://github.com/Fewword/Poc/blob/main/smf/smf-… | exploit |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| SimpleMachines | SMF |
Affected:
2.1.4
|
|
| simplemachines | simple_machine_forum |
Affected:
2.1.4
cpe:2.3:a:simplemachines:simple_machine_forum:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:simplemachines:simple_machine_forum:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "simple_machine_forum",
"vendor": "simplemachines",
"versions": [
{
"status": "affected",
"version": "2.1.4"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-7437",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-06T14:21:49.377339Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-06T14:24:08.526Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Delete User Handler"
],
"product": "SMF",
"vendor": "SimpleMachines",
"versions": [
{
"status": "affected",
"version": "2.1.4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Fewwords (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability, which was classified as critical, was found in SimpleMachines SMF 2.1.4. Affected is an unknown function of the file /index.php?action=profile;u=2;area=showalerts;do=remove of the component Delete User Handler. The manipulation of the argument aid leads to improper control of resource identifiers. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used."
},
{
"lang": "de",
"value": "Es wurde eine Schwachstelle in SimpleMachines SMF 2.1.4 gefunden. Sie wurde als kritisch eingestuft. Es geht dabei um eine nicht klar definierte Funktion der Datei /index.php?action=profile;u=2;area=showalerts;do=remove der Komponente Delete User Handler. Durch das Manipulieren des Arguments aid mit unbekannten Daten kann eine improper control of resource identifiers-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.5,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-99",
"description": "CWE-99 Improper Control of Resource Identifiers",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-10T06:26:10.103Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-273522 | SimpleMachines SMF Delete User index.php resource injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.273522"
},
{
"name": "VDB-273522 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.273522"
},
{
"name": "Submit #380189 | SimpleMachines SMF 2.1.4 Insecure Direct Object Reference",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.380189"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/Fewword/Poc/blob/main/smf/smf-poc1.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-08-02T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2024-08-02T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2024-08-10T08:31:03.000Z",
"value": "VulDB entry last update"
}
],
"title": "SimpleMachines SMF Delete User index.php resource injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2024-7437",
"datePublished": "2024-08-03T14:31:04.930Z",
"dateReserved": "2024-08-02T21:22:25.233Z",
"dateUpdated": "2024-08-10T06:26:10.103Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-11574 (GCVE-0-2019-11574)
Vulnerability from cvelistv5 – Published: 2020-03-20 22:08 – Updated: 2024-08-04 22:55
VLAI
EPSS
VEX
Summary
An issue was discovered in Simple Machines Forum (SMF) before release 2.0.17. There is SSRF related to Subs-Package.php and Subs.php because user-supplied data is used directly in curl calls.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.simplemachines.org/community/index.ph… | x_refsource_MISC |
| https://pastebin.com/raw/prE3iiLm | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T22:55:40.913Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.simplemachines.org/community/index.php?board=1.0"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://pastebin.com/raw/prE3iiLm"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in Simple Machines Forum (SMF) before release 2.0.17. There is SSRF related to Subs-Package.php and Subs.php because user-supplied data is used directly in curl calls."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-03-20T22:08:06.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.simplemachines.org/community/index.php?board=1.0"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://pastebin.com/raw/prE3iiLm"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-11574",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in Simple Machines Forum (SMF) before release 2.0.17. There is SSRF related to Subs-Package.php and Subs.php because user-supplied data is used directly in curl calls."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.simplemachines.org/community/index.php?board=1.0",
"refsource": "MISC",
"url": "https://www.simplemachines.org/community/index.php?board=1.0"
},
{
"name": "https://pastebin.com/raw/prE3iiLm",
"refsource": "MISC",
"url": "https://pastebin.com/raw/prE3iiLm"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-11574",
"datePublished": "2020-03-20T22:08:06.000Z",
"dateReserved": "2019-04-27T00:00:00.000Z",
"dateUpdated": "2024-08-04T22:55:40.913Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2005-4891 (GCVE-0-2005-4891)
Vulnerability from cvelistv5 – Published: 2020-01-15 16:09 – Updated: 2024-08-08 00:01
VLAI
EPSS
VEX
Summary
Simple Machine Forum (SMF) versions 1.0.4 and earlier have an SQL injection vulnerability that allows remote attackers to inject arbitrary SQL statements.
Severity
No CVSS data available.
CWE
- SQL Injection
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://www.openwall.com/lists/oss-security/2012/1… | x_refsource_MISC |
| https://securiteam.com/exploits/5HP0N0KG0O/ | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Simple Machine Forum | Simple Machine Forum |
Affected:
1.0.4 and earlier
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T00:01:23.502Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/11/14/10"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://securiteam.com/exploits/5HP0N0KG0O/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Simple Machine Forum",
"vendor": "Simple Machine Forum",
"versions": [
{
"status": "affected",
"version": "1.0.4 and earlier"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Simple Machine Forum (SMF) versions 1.0.4 and earlier have an SQL injection vulnerability that allows remote attackers to inject arbitrary SQL statements."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "SQL Injection",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-01-15T16:09:27.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.openwall.com/lists/oss-security/2012/11/14/10"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://securiteam.com/exploits/5HP0N0KG0O/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2005-4891",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Simple Machine Forum",
"version": {
"version_data": [
{
"version_value": "1.0.4 and earlier"
}
]
}
}
]
},
"vendor_name": "Simple Machine Forum"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Simple Machine Forum (SMF) versions 1.0.4 and earlier have an SQL injection vulnerability that allows remote attackers to inject arbitrary SQL statements."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "SQL Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.openwall.com/lists/oss-security/2012/11/14/10",
"refsource": "MISC",
"url": "http://www.openwall.com/lists/oss-security/2012/11/14/10"
},
{
"name": "https://securiteam.com/exploits/5HP0N0KG0O/",
"refsource": "MISC",
"url": "https://securiteam.com/exploits/5HP0N0KG0O/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2005-4891",
"datePublished": "2020-01-15T16:09:27.000Z",
"dateReserved": "2011-12-19T00:00:00.000Z",
"dateUpdated": "2024-08-08T00:01:23.502Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}