CVE-2005-4159: SQL Injection
DISPUTED NOTE: this issue has been disputed by the vendor and third parties. SQL injection vulnerability in Memberlist.php in Simple Machines Forum (SMF) 1.1 rc1 and earlier allows remote attackers to execute arbitrary SQL commands via the start parameter. NOTE: the vendor says that since only one character can be modified, there is no SQL injection. Thus this might be an "invalid SQL syntax error." Multiple followups support the vendor.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2005-4159?
The severity of CVE-2005-4159 is disputed, but it is categorized as an SQL injection vulnerability that could lead to remote code execution.
How do I fix CVE-2005-4159?
To fix CVE-2005-4159, upgrade your Simple Machines Forum to a version later than 1.1 rc1.
What software is affected by CVE-2005-4159?
CVE-2005-4159 affects Simple Machines Forum version 1.1 rc1 and earlier.
Can CVE-2005-4159 be exploited remotely?
Yes, CVE-2005-4159 can be exploited remotely by attackers to execute arbitrary SQL commands.
Is CVE-2005-4159 still a concern for users of Simple Machines Forum?
While the vulnerability is from 2005, it is still a concern for users who have not updated to a secure version.