Security Advisory

CVE-2008-6658

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2009-04-07 19:00:00

Last updated 2024-08-07 11:34:47

Assigner mitre

State PUBLISHED

Description

Directory traversal vulnerability in index.php in Simple Machines Forum (SMF) 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote authenticated administrators to install packages from arbitrary directories via a .. (dot dot) in the package parameter during an install2 action, as demonstrated by a predictable package filename in attachments/ that was uploaded through a post2 action to index.php.

← Browse all CVEs View on cve.org ↗