Smf
Monthly
Authorization state-confusion in Simple Machines Forum (SMF) through version 2.1.7 enables any authenticated low-privileged user to escalate privileges to administrator without possessing admin credentials. The vulnerability stems from a mismatch between Profile::$member and User::$me->is_owner during sequential profile loading when multiple values are supplied for the user parameter, tricking the application into treating the attacker as the owner of an administrator profile and granting access to password-change functionality. No CISA KEV listing or confirmed public exploit code exists at time of analysis, but the CVSS 4.0 score of 8.6, low attack complexity, and minimal authentication barrier - any registered user qualifies - make this a critical priority for all SMF operators.
Server-side request forgery in Simple Machines Forum's image proxy allows any authenticated forum member to force the SMF host to make arbitrary internal HTTP requests by embedding attacker-controlled URLs in BBCode image tags. Because SMF automatically generates HMAC signatures authorizing any image URL the proxy encounters, an attacker can obtain a valid signed request targeting cloud instance metadata endpoints (169.254.169.254), RFC1918 internal web applications, and container network services - with no public exploit code identified at time of analysis and no CISA KEV listing. The highest-impact exposure is in cloud-hosted deployments where IMDS credential theft via SSRF could enable lateral movement beyond the SMF host itself.
Authorization bypass in Simple Machines Forum (SMF) 2.1 before 2.1.8 and 3.0 before 3.0 Alpha 5 lets any authenticated low-privileged member manipulate the attachment moderation queue without the required approve_posts permission. A single-character operator mistake in Sources/Actions/AttachmentApprove.php makes the permission check evaluate to true for everyone, so an ordinary user can approve, reject, or delete pending attachments on any board and enumerate other users' unapproved uploads. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the flaw was reported by VulnCheck and a vendor patch is available.
free5GC SMF versions up to 1.4.1 crash when receiving malformed PFCP SessionReportRequest packets on UDP port 8805, allowing unauthenticated remote attackers to cause denial of service. Public exploit code exists for this vulnerability, and no official patch is currently available, requiring organizations to implement network-level mitigations such as ACL restrictions or PFCP message inspection.
free5GC SMF versions up to 1.4.1 crash when processing malformed PFCP SessionReportRequest messages on the UDP/8805 interface, allowing unauthenticated remote attackers to cause denial of service. Public exploit code exists for this vulnerability, and no upstream patch is currently available. Organizations running affected SMF instances should restrict PFCP interface access to trusted UPF nodes and implement network-level filtering of malformed requests.
free5GC SMF versions up to 1.4.1 crash when processing malformed PFCP SessionReportRequest messages on the PFCP interface, allowing unauthenticated remote attackers to cause denial of service via nil pointer dereference. Public exploit code exists for this vulnerability and no upstream patch is currently available. Network operators should restrict PFCP interface access to trusted UPF sources and consider implementing message validation at network boundaries.
free5GC is an open-source project for 5th generation (5G) mobile core networks. free5GC go-upf versions up to and including 1.2.6, corresponding to free5gc smf up to and including 1.4.0, have an Improper Input Validation and Protocol Compliance vulnerability leading to Denial of Service. [CVSS 7.5 HIGH]
Buffer Overflow vulnerability in free5gc 3.3.0, UPF 1.2.0, and SMF 1.2.0 allows attackers to cause a denial of service via crafted PFCP messages. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) vulnerability in Simple Machines Forum (SMF) 2.0.2 allows remote attackers to inject arbitrary web script or HTML via the scheduled parameter to index.php. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Authorization state-confusion in Simple Machines Forum (SMF) through version 2.1.7 enables any authenticated low-privileged user to escalate privileges to administrator without possessing admin credentials. The vulnerability stems from a mismatch between Profile::$member and User::$me->is_owner during sequential profile loading when multiple values are supplied for the user parameter, tricking the application into treating the attacker as the owner of an administrator profile and granting access to password-change functionality. No CISA KEV listing or confirmed public exploit code exists at time of analysis, but the CVSS 4.0 score of 8.6, low attack complexity, and minimal authentication barrier - any registered user qualifies - make this a critical priority for all SMF operators.
Server-side request forgery in Simple Machines Forum's image proxy allows any authenticated forum member to force the SMF host to make arbitrary internal HTTP requests by embedding attacker-controlled URLs in BBCode image tags. Because SMF automatically generates HMAC signatures authorizing any image URL the proxy encounters, an attacker can obtain a valid signed request targeting cloud instance metadata endpoints (169.254.169.254), RFC1918 internal web applications, and container network services - with no public exploit code identified at time of analysis and no CISA KEV listing. The highest-impact exposure is in cloud-hosted deployments where IMDS credential theft via SSRF could enable lateral movement beyond the SMF host itself.
Authorization bypass in Simple Machines Forum (SMF) 2.1 before 2.1.8 and 3.0 before 3.0 Alpha 5 lets any authenticated low-privileged member manipulate the attachment moderation queue without the required approve_posts permission. A single-character operator mistake in Sources/Actions/AttachmentApprove.php makes the permission check evaluate to true for everyone, so an ordinary user can approve, reject, or delete pending attachments on any board and enumerate other users' unapproved uploads. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the flaw was reported by VulnCheck and a vendor patch is available.
free5GC SMF versions up to 1.4.1 crash when receiving malformed PFCP SessionReportRequest packets on UDP port 8805, allowing unauthenticated remote attackers to cause denial of service. Public exploit code exists for this vulnerability, and no official patch is currently available, requiring organizations to implement network-level mitigations such as ACL restrictions or PFCP message inspection.
free5GC SMF versions up to 1.4.1 crash when processing malformed PFCP SessionReportRequest messages on the UDP/8805 interface, allowing unauthenticated remote attackers to cause denial of service. Public exploit code exists for this vulnerability, and no upstream patch is currently available. Organizations running affected SMF instances should restrict PFCP interface access to trusted UPF nodes and implement network-level filtering of malformed requests.
free5GC SMF versions up to 1.4.1 crash when processing malformed PFCP SessionReportRequest messages on the PFCP interface, allowing unauthenticated remote attackers to cause denial of service via nil pointer dereference. Public exploit code exists for this vulnerability and no upstream patch is currently available. Network operators should restrict PFCP interface access to trusted UPF sources and consider implementing message validation at network boundaries.
free5GC is an open-source project for 5th generation (5G) mobile core networks. free5GC go-upf versions up to and including 1.2.6, corresponding to free5gc smf up to and including 1.4.0, have an Improper Input Validation and Protocol Compliance vulnerability leading to Denial of Service. [CVSS 7.5 HIGH]
Buffer Overflow vulnerability in free5gc 3.3.0, UPF 1.2.0, and SMF 1.2.0 allows attackers to cause a denial of service via crafted PFCP messages. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) vulnerability in Simple Machines Forum (SMF) 2.0.2 allows remote attackers to inject arbitrary web script or HTML via the scheduled parameter to index.php. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.