CVE-2008-6657

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-04-07 · updated 2026-06-16
Weakness: CWE-352

Description

Cross-site request forgery (CSRF) vulnerability in index.php in Simple Machines Forum (SMF) 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote attackers to hijack the authentication of admins for requests that install packages via the package parameter in an install2 action.

Affected products

Simple Machines Forum: 1.0.5, 1.0.6, 1.0.7, 1.0.11, 1.0.12, 1.1.1 (+8)

References

http://osvdb.org/50071
http://secunia.com/advisories/32516
http://www.securityfocus.com/bid/32119
http://www.simplemachines.org/community/index.php?topic=272861.0
https://exchange.xforce.ibmcloud.com/vulnerabilities/46343
https://www.exploit-db.com/exploits/6993
http://osvdb.org/50071
http://secunia.com/advisories/32516
http://www.securityfocus.com/bid/32119
http://www.simplemachines.org/community/index.php?topic=272861.0
https://exchange.xforce.ibmcloud.com/vulnerabilities/46343
https://www.exploit-db.com/exploits/6993

Get alerted when CVE-2008-6657 or the next vulnerability affects your stack