CVE-2008-6658

2009-04-07 21:30:00 2017-09-29 03:33:16

Directory traversal vulnerability in index.php in Simple Machines Forum (SMF) 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote authenticated administrators to install packages from arbitrary directories via a .. (dot dot) in the package parameter during an install2 action, as demonstrated by a predictable package filename in attachments/ that was uploaded through a post2 action to index.php.

Vector

NETWORK

Complexity

LOW

Authentication

SINGLE_INSTANCE

Confidentiality

NONE

Integrity

PARTIAL

Availability

NONE

Simple machines Simple machines forum 1.1.2 (not an official CPE) Simple machines Simple machines forum 1.1.5 (not an official CPE) Simple machines Simple machines forum 1.0.6 (not an official CPE) Simple machines Simple machines forum 1.1.4 (not an official CPE) Simple machines Simple machines forum 1.1 rc1 (not an official CPE) Simple machines Simple machines forum 1.0.5 (not an official CPE) Simple machines Simple machines forum 1.1 rc3 (not an official CPE) Simple machines Simple machines forum 1.0.11 (not an official CPE) Simple machines Simple machines forum 1.1 rc2 (not an official CPE) Simple machines Simple machines forum 1.1.1 (not an official CPE) Simple machines Simple machines forum 1.0.12 (not an official CPE) Simple machines Simple machines forum 1.1.3 (not an official CPE) Simple machines Simple machines forum 1.0.7 (not an official CPE) Simple machines Simple machines forum 1.1.6 (not an official CPE)

Simple machines - Simple machines forum

Advisory	Patch	Confirmed	Link
			6993
			http://www.simplemachines.org/community/index.php?topic=...

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (ID 22)

Related CAPEC 7 Relative Path Traversal (CAPEC-ID 139) Directory Traversal (CAPEC-ID 213) File System Function Injection, Content Based (CAPEC-ID 23) Using Slashes and URL Encoding Combined to Bypass Validation Logic (CAPEC-ID 64) Manipulating Input to File System Calls (CAPEC-ID 76) Using Escaped Slashes in Alternate Encoding (CAPEC-ID 78) Using Slashes in Alternate Encoding (CAPEC-ID 79)