JVN#34205166: SYNCK GRAPHICA Mailform Pro CGI vulnerable to information disclosure

Mailform Pro CGI provided by SYNCK GRAPHICA contains an information disclosure vulnerability (CWE-200).

Thanks module of this product saves user input data for a certain period of time. The time is set to 30 seconds by default in configs/thanks.cgi file. To exploit this vulnerability, it is required for an attacker to access the affected product within 30 seconds.

Impact

By having a use of the product to access a specially crafted URL by an attacker, the user input data may be disclosed.

Solution

Update the Software
Update the software to the latest version according to the information provided by the developer.

Apply a workaround
The following workaround may mitigate the impact of this vulnerability.

• Disable thanks module

Products Affected

• Mailform Pro CGI 4.3.1 and earlier
  According to the developer, Mailform Pro CGI is affected when thanks module is enabled.