Simple Machines Forum Password Reset Security Bypass Vulnerability

Bugtraq ID:	33219
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 12 2009 12:00AM
Updated:	Feb 06 2009 11:18PM
Credit:	Xianur0
Vulnerable:	Simple Machines SMF 1.1.5 Simple Machines SMF 1.1.5 Simple Machines SMF 1.1.4 Simple Machines SMF 1.1.3 Simple Machines SMF 1.1.2 Simple Machines SMF 1.1.1 Simple Machines SMF 1.1 rc3 Simple Machines SMF 1.1 rc3 Simple Machines SMF 1.1 rc2 Simple Machines SMF 1.1 rc1 Simple Machines SMF 1.1 final Simple Machines SMF 1.0.13 Simple Machines SMF 1.0.13 Simple Machines SMF 1.0.12 Simple Machines SMF 1.0.12 Simple Machines SMF 1.0.11 Simple Machines SMF 1.0.10 Simple Machines SMF 1.0.9 Simple Machines SMF 1.0.8 Simple Machines SMF 1.0.8 Simple Machines SMF 1.0.7 Simple Machines SMF 1.0.6 Simple Machines SMF 1.0.5 Simple Machines SMF 1.0.4 Simple Machines SMF 1.0.3 Simple Machines SMF 1.0.2 Simple Machines SMF 1.0.1 Simple Machines SMF 1.0 -beta5p Simple Machines SMF 1.0 -beta4p Simple Machines SMF 1.0 -beta4.1 Simple Machines Simple Machines Forum 1.1.5 Simple Machines Simple Machines Forum 1.1.4 Simple Machines Simple Machines Forum 1.1.3 Simple Machines Simple Machines Forum 1.1.2 Simple Machines Simple Machines Forum 1.1.1
Not Vulnerable:	Simple Machines Simple Machines Forum 1.1.6 Simple Machines Simple Machines Forum 1.0.14

Attackers can exploit this issue via a browser.

The following exploit code is available:

http://www.securityfocus.com/data/vulnerabilities/exploits/33219.pl