QueryString.php in Simple Machines Forum (SMF) 1.0.7 and earlier, and 1.1rc2 and earlier, allows remote attackers to more easily spoof the IP address and evade banning via a modified X-Forwarded-For HTTP header, which is preferred instead of other more reliable sources for the IP address. NOTE: the original researcher claims that the vendor has disputed this issue
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Simple_machines_forum | Simple_machines | * | 1.0.7 (including) |
| Simple_machines_forum | Simple_machines | * | 1.1_rc2 (including) |