7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.003 Low
EPSS
Percentile
69.0%
PHP FormMail Generator is a single-instance website that generates PHP code for standard web forms for inclusion into PHP or WordPress websites. The generated code is vulnerable to authentication bypass and unsafe deserialization of untrusted data.
CWE-302**: Authentication Bypass by Assumed-Immutable Data -**CVE-2016-9482
A remote unauthenticated user may bypass authentication to access the administrator panel by navigating directly to:`
/admin.php?mod=admin&func=panel`
CWE-502**: Deserialization of Untrusted Data -**CVE-2016-9483
The generated PHP form code deserializes untrusted input as part of the phpfmg_filman_download()
function. A remote unauthenticated attacker may be able to use this vulnerability to inject PHP code, or along with CVE-2016-9484 (below) to perform local file inclusion attacks and obtain files from the server.
CWE-22**: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) -**CVE-2016-9484
The generated PHP form code does not properly validate user input folder directories, allowing a remote unauthenticated attacker to perform a path traversal and access arbitrary files on the server.
The PHP FormMail Generator website does not use version numbers and is updated continuously. Any PHP form code generated by this website prior to 2016-12-06 may be vulnerable.
An unauthenticated remote user may be able to gain access to the form’s administrator panel, or obtain files from the server.
Regenerate your PHP form code
The PHP FormMail Generator website as of 2016-12-06 generates PHP code that addresses these issues. Affected users are encouraged to regenerate the PHP form code using the website, or manually apply patches.
494015
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
Notified: November 29, 2016 Updated: December 08, 2016
Statement Date: December 01, 2016
Affected
We have not received a statement from the vendor.
The PHP code generated as of 20161206 addresses the vulnerabilities reported.
Group | Score | Vector |
---|---|---|
Base | 10 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Temporal | 10 | E:ND/RL:ND/RC:ND |
Environmental | 7.5 | CDP:ND/TD:M/CR:ND/IR:ND/AR:ND |
Thanks to Pouya Darabi for reporting this vulnerability.
This document was written by Garret Wassermann.
CVE IDs: | CVE-2016-9482, CVE-2016-9483, CVE-2016-9484 |
---|---|
Date Public: | 2016-12-05 Date First Published: |
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.003 Low
EPSS
Percentile
69.0%