CVE-2008-6657: CSRF
First published: Tue Apr 07 2009(Updated: )
Cross-site request forgery (CSRF) vulnerability in index.php in Simple Machines Forum (SMF) 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote attackers to hijack the authentication of admins for requests that install packages via the package parameter in an install2 action.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Simple Machines Forum | =1.0.11 | |
| Simple Machines Forum | =1.1.5 | |
| Simple Machines Forum | =1.1.1 | |
| Simple Machines Forum | =1.0.7 | |
| Simple Machines Forum | =1.1.4 | |
| Simple Machines Forum | =1.1_rc1 | |
| Simple Machines Forum | =1.0.5 | |
| Simple Machines Forum | =1.1.6 | |
| Simple Machines Forum | =1.1_rc3 | |
| Simple Machines Forum | =1.1_rc2 | |
| Simple Machines Forum | =1.1.3 | |
| Simple Machines Forum | =1.0.6 | |
| Simple Machines Forum | =1.1.2 | |
| Simple Machines Forum | =1.0.12 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2008-6657?
CVE-2008-6657 has a high severity rating as it allows remote attackers to hijack admin authentication.
How do I fix CVE-2008-6657?
To fix CVE-2008-6657, you should upgrade your Simple Machines Forum to version 1.0.15 or 1.1.7 or later.
What versions are affected by CVE-2008-6657?
CVE-2008-6657 affects Simple Machines Forum versions 1.0.11 through 1.0.14 and 1.1.1 through 1.1.6.
Can CVE-2008-6657 be exploited without user interaction?
Yes, CVE-2008-6657 can be exploited without user interaction via crafted requests.
What type of vulnerability is CVE-2008-6657?
CVE-2008-6657 is a Cross-site request forgery (CSRF) vulnerability.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- agent/weakness
- vendor/simple machines
- canonical/simple machines forum
- version/simple machines forum/1.0.11
- version/simple machines forum/1.1.5
- version/simple machines forum/1.1.1
- version/simple machines forum/1.0.7
- version/simple machines forum/1.1.4
- version/simple machines forum/1.1_rc1
- version/simple machines forum/1.0.5
- version/simple machines forum/1.1.6
- version/simple machines forum/1.1_rc3
- version/simple machines forum/1.1_rc2
- version/simple machines forum/1.1.3
- version/simple machines forum/1.0.6
- version/simple machines forum/1.1.2
- version/simple machines forum/1.0.12