CVE-2008-6659: Path Traversal
Directory traversal vulnerability in index.php in Simple Machines Forum (SMF) 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote authenticated users to configure arbitrary local files for execution via directory traversal sequences in the value of the themedir field during a jsoption action, related to Sources/QueryString.php and Sources/Themes.php, as demonstrated by a local .gif file in attachments/ with PHP code that was uploaded through a profile2 action to index.php.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-6659?
CVE-2008-6659 has a medium severity rating due to its potential for directory traversal attacks.
How do I fix CVE-2008-6659?
To fix CVE-2008-6659, upgrade Simple Machines Forum to versions 1.0.15 or 1.1.7 or later.
What are the affected versions for CVE-2008-6659?
CVE-2008-6659 affects Simple Machines Forum versions 1.0.5 through 1.0.12 and 1.1.1 through 1.1.rc3.
Can CVE-2008-6659 be exploited by unauthenticated users?
No, CVE-2008-6659 requires remote authenticated users to exploit the vulnerability.
What type of vulnerability is CVE-2008-6659?
CVE-2008-6659 is classified as a directory traversal vulnerability.