CVEvulnerability

CVE-2006-7013

7.5 HIGH Published 2007-02-15 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2007-02-15
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P

Description

QueryString.php in Simple Machines Forum (SMF) 1.0.7 and earlier, and 1.1rc2 and earlier, allows remote attackers to more easily spoof the IP address and evade banning via a modified X-Forwarded-For HTTP header, which is preferred instead of other more reliable sources for the IP address. NOTE: the original researcher claims that the vendor has disputed this issue

Affected configurations

• simple machines simple machines forum (<= 1.0.7) • simple machines simple machines forum (<= 1.1 rc2)

References