CVE-2013-7236
HighSummary
Simple Machines Forum (SMF) versions 2.0.6, 1.1.19, and earlier allow remote attackers to impersonate arbitrary users via a Unicode homoglyph character in a username.
Risk Assessment
Attackers can exploit this vulnerability to impersonate other users, potentially leading to unauthorized access to forum data and functions.
Recommendation
It is recommended to upgrade to the latest version of SMF to mitigate this vulnerability and to monitor usernames for suspicious characters.
Other vulnerabilities in Simple Machines Forum (SMF)
See all- CVE-2016-5727High
LogInOut.php in Simple Machines Forum (SMF) 2.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via vectors related to variables derived from user input in a foreach loop.
- CVE-2013-7235High
Simple Machines Forum (SMF) before 1.1.19 and 2.x before 2.0.6 allows remote attackers to impersonate arbitrary users via multiple space characters.
- CVE-2016-5726Critical
The Packages.php file in Simple Machines Forum (SMF) 2.1 contains a vulnerability that allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the themechanges array parameter.
Original NVD description (English source)
Simple Machines Forum (SMF) 2.0.6, 1.1.19, and earlier allows remote attackers to impersonate arbitrary users via a Unicode homoglyph character in a username.