CVE-2005-4891

moderate-risk

Published 2020-01-15

Simple Machine Forum (SMF) versions 1.0.4 and earlier have an SQL injection vulnerability that allows remote attackers to inject arbitrary SQL statements.

Do I need to act?

0.37% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

1 public exploit available

1057

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 9.8/10 Critical

NETWORK / LOW complexity

Affected Products (1)

Simple Machine Forum

Affected Vendors

Simplemachines

References (4)

Mailing List http://www.openwall.com/lists/oss-security/2012/11/14/10

Exploit https://securiteam.com/exploits/5HP0N0KG0O/

Mailing List http://www.openwall.com/lists/oss-security/2012/11/14/10

Exploit https://securiteam.com/exploits/5HP0N0KG0O/

/ 100

moderate-risk

Severity 32/34 · Critical

Exploitability 8/34 · Low

Exposure 5/34 · Minimal