CVE-2016-5726
CriticalSummary
The Packages.php file in Simple Machines Forum (SMF) 2.1 contains a vulnerability that allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the themechanges array parameter.
Risk Assessment
Attackers can exploit this vulnerability to execute code remotely, potentially leading to system takeover or data leakage.
Recommendation
It is recommended to update to the latest version of SMF to mitigate this vulnerability and to monitor the system for unauthorized activities.
Other vulnerabilities in Simple Machines Forum (SMF) 2.1
See all- CVE-2016-5727High
LogInOut.php in Simple Machines Forum (SMF) 2.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via vectors related to variables derived from user input in a foreach loop.
- CVE-2013-7236High
Simple Machines Forum (SMF) versions 2.0.6, 1.1.19, and earlier allow remote attackers to impersonate arbitrary users via a Unicode homoglyph character in a username.
- CVE-2013-7235High
Simple Machines Forum (SMF) before 1.1.19 and 2.x before 2.0.6 allows remote attackers to impersonate arbitrary users via multiple space characters.
Original NVD description (English source)
Packages.php in Simple Machines Forum (SMF) 2.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the themechanges array parameter.