CVE-2016-5726

Critical

Published: 09/02/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The Packages.php file in Simple Machines Forum (SMF) 2.1 contains a vulnerability that allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the themechanges array parameter.

Risk Assessment

Attackers can exploit this vulnerability to execute code remotely, potentially leading to system takeover or data leakage.

Recommendation

It is recommended to update to the latest version of SMF to mitigate this vulnerability and to monitor the system for unauthorized activities.

Original NVD description (English source)

Packages.php in Simple Machines Forum (SMF) 2.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the themechanges array parameter.