Simple Machines Forum Multiple Security Vulnerabilities
Simple Machines Forum is prone to multiple security vulnerabilities, including a remote PHP code-execution vulnerability, multiple cross-site scripting vulnerabilities, multiple cross-site request-forgery vulnerabilities, an information-disclosure vulnerability, and multiple denial-of-service vulnerabilities. Attackers can exploit these issues to execute arbitrary script code within the context of the webserver, perform unauthorized actions on behalf of legitimate users, compromise the affected application, steal cookie-based authentication credentials, obtain information that could aid in further attacks or cause denial-of-service conditions. An attacker can use a browser to exploit these issues. To exploit the cross-site scripting and cross-site request-forgery vulnerabilities, the attacker must entice an unsuspecting victim into following a malicious URI.
