Description
Session fixation vulnerability in Simple Machines Forum (SMF) 1.1.2 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter.
References (7)
Core 7
Core References
Various Sources x_refsource_misc
http://www.majorsecurity.de/index_2.php?major_rls=major_rls47
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/25139
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/471414/100/0/threaded
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://osvdb.org/35705
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/467748/100/0/threaded
Third Party Advisory third-party-advisory
x_refsource_sreason
http://securityreason.com/securityalert/2676
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/24482
Scores
EPSS
0.0149
EPSS Percentile
70.9%
Details
CWE
CWE-287
Status
published
Products (1)
simple_machines/simple_machines_forum
< 1.1.2
Published
May 09, 2007
Tracked Since
Feb 18, 2026