Simple Machines Forum Memberlist.php SQL Injection Vulnerability

[DomDom Skye]

Hello

I discover this:

Simple Machines Forum is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

This vulnerability could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks. A successful attack can allow an attacker to bypass administrator login and gain administrative access to a site.

Simple Machines Forum 1.1 rc1 is vulnerable. Other versions may also be affected.

http://www.securityfocus.com/bid/15791/exploit

Any patch?

Regards, Dom

[kuklovod]

not a bug.
http://www.simplemachines.org/community/index.php?topic=60037.0

[DomDom Skye]

Yesssss thx!

Dom