What’s Vulnerable › Vulnerabilities

CVE-2006-7013

• Severity: high (CVSS 7.5 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2007-02-15 · updated 2026-06-16

Description

QueryString.php in Simple Machines Forum (SMF) 1.0.7 and earlier, and 1.1rc2 and earlier, allows remote attackers to more easily spoof the IP address and evade banning via a modified X-Forwarded-For HTTP header, which is preferred instead of other more reliable sources for the IP address. NOTE: the original researcher claims that the vendor has disputed this issue

Affected products

• Simple Machines Forum: through 1.0.7; through 1.1_rc2

References

• http://securityreason.com/securityalert/2256
• http://www.securityfocus.com/archive/1/435686/30/4740/threaded
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27082
• http://securityreason.com/securityalert/2256
• http://www.securityfocus.com/archive/1/435686/30/4740/threaded
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27082

Get alerted when CVE-2006-7013 or the next vulnerability affects your stack