CVE-2022-26982

Published: Apr 5, 2022Modified: Jun 17, 2026

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: NVD

Description

SimpleMachinesForum 2.1.1 and earlier allows remote authenticated administrators to execute arbitrary code by inserting a vulnerable php code because the themes can be modified by an administrator. NOTE: the vendor's position is that administrators are intended to have the ability to modify themes, and can thus choose any PHP code that they wish to have executed on the server.

Affected (1)

Products: Simplemachines: Simple Machines Forum

1 product

Simple Machines Forum

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Simplemachines Simple Machines Forum	Up to 2.1.1

Related CWEs

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (4)

http://packetstormsecurity.com/files/171486/SimpleMachinesForum-2.1.1-Remote-Code-Execution.html

Source: cve@mitre.org

https://github.com/sartlabs/0days/blob/main/SimpleMachinesForum/Exploit.txt

Source: cve@mitre.org

ExploitThird Party Advisory

http://packetstormsecurity.com/files/171486/SimpleMachinesForum-2.1.1-Remote-Code-Execution.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/sartlabs/0days/blob/main/SimpleMachinesForum/Exploit.txt

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.