Sql injection

2009-04-2118:30:00

PRIOn knowledge base

www.prio-n.com

9 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

27.8%

JSON

SQL injection vulnerability in Load.php in Simple Machines Forum (SMF) 1.1.4 and earlier allows remote attackers to execute arbitrary SQL commands by setting the db_character_set parameter to a multibyte character set such as big5, which causes the addslashes PHP function to produce a "" (backslash) sequence that does not quote the “'” (single quote) character, as demonstrated via a manlabels action to index.php.

CPENameOperatorVersion
simple_machines_forumeq1.0.11
simple_machines_forumeq1.1.1
simple_machines_forumeq1.0.7
simple_machines_forumeq1.1 rc3
simple_machines_forumle1.1.4
simple_machines_forumeq1.0.5
simple_machines_forumeq1.1 rc2
simple_machines_forumeq1.1.3
simple_machines_forumeq1.0.6
simple_machines_forumeq1.1 rc1

Name	Operator	Version
simple_machines_forum	eq	1.0.11
simple_machines_forum	eq	1.1.1
simple_machines_forum	eq	1.0.7
simple_machines_forum	eq	1.1 rc3
simple_machines_forum	le	1.1.4
simple_machines_forum	eq	1.0.5
simple_machines_forum	eq	1.1 rc2
simple_machines_forum	eq	1.1.3
simple_machines_forum	eq	1.0.6
simple_machines_forum	eq	1.1 rc1