CVE-2006-6375: XSS

Published Dec 7, 2006

Updated

Cross-site scripting (XSS) vulnerability in display.php in Simple Machines Forum (SMF) 1.1 Final and earlier allows remote attackers to inject arbitrary web script or HTML via the contents of a file that is uploaded with the image parameter set, which can be interpreted as script by Internet Explorer's automatic type detection.

Affected Software

4 affected components

Simple Machines SMF=1.0.9

Simple Machines SMF=1.0_beta5p

Simple Machines SMF=1.1_final

Simple Machines SMF=1.1_rc3

Remediation

Patch Available

http://secunia.com/advisories/23175

Event History

Dec 7, 2006

CVE Published

05:28 PM

Data Sourced

via NVD·05:28 PM

RemedyDescriptionSeverityAffected Software

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2006-6375?

The severity of CVE-2006-6375 is classified as high due to the potential for remote code execution through cross-site scripting.

How do I fix CVE-2006-6375?

To fix CVE-2006-6375, upgrade to a patched version of Simple Machines Forum that addresses the cross-site scripting vulnerability.

Who is affected by CVE-2006-6375?

CVE-2006-6375 affects Simple Machines Forum versions 1.0.9, 1.0 Beta 5p, 1.1 RC3, and 1.1 Final.

What type of vulnerability is CVE-2006-6375?

CVE-2006-6375 is a cross-site scripting (XSS) vulnerability.

What can attackers achieve with CVE-2006-6375?

Attackers can inject arbitrary web script or HTML into web pages viewed by users, potentially leading to session hijacking or other malicious activities.