CVE-2009-5068: There is a file disclosure vulnerability in SMF (Simple Machines Forum) affecting versions through v2.0.3. On some configurations a SMF deployment is shared by…

PriorityP347high7.2CVSS 3.1

AVNACLPRHUINSUCHIHAH

EXPLOIT

EPSS

1.73%

74.8th percentile

There is a file disclosure vulnerability in SMF (Simple Machines Forum) affecting versions through v2.0.3. On some configurations a SMF deployment is shared by several "co-admins" that are not trusted beyond the SMF deployment. This vulnerability allows them to read arbitrary files on the filesystem and therefore gain new privileges by reading the settings.php with the database passwords.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
simplemachines	simple_machines_forum	<= 2.0.3	—
smf	smf	—	—

CVSS provenance

nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

nvdv2.03.5LOWAV:N/AC:M/Au:S/C:P/I:N/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.