Vulnerable: Simple Machine Forum [ALL Versions]
Tested on SMF 1.1.4
Type: Private Section,Posts,Information disclosure.
Risk: Low / Medium
Discovered By Seph1roth
Explanation:
If some section is rescricted only for staff,vips or private groups/members,this bug can be used for
read entire section and message, without privileges.
Example:
In my forum i've a Staff area , and into that , there is a message that contain Bug,exploit or some
others keywords…i'll put in the advanced search module # this keywords ,and i select "show results as
messages"…and tadaaa…my priv8 zone can be read by everyone…
Greetz to all BlackRoots users!
Shoutz to all kiddies!