CVE-2007-2546

Simple Machines Forum <1.1.2 - Info Disclosure

Title source: llm

Description

Session fixation vulnerability in Simple Machines Forum (SMF) 1.1.2 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter.

References (7)

[Vendor Advisory] http://secunia.com/advisories/25139

[Various Sources] http://www.majorsecurity.de/index_2.php?major_rls=major_rls47

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/467748/100/0/threaded

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/471414/100/0/threaded

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/24482

[Third Party Advisory, VDB Entry] http://osvdb.org/35705

[Third Party Advisory] http://securityreason.com/securityalert/2676

Scores

EPSS 0.0145

EPSS Percentile 80.6%

Classification

CWE

CWE-287

Status draft

Affected Products (1)

simple_machines/simple_machines_forum < 1.1.2

Timeline

Published May 09, 2007

Tracked Since Feb 18, 2026