CVE-2016-9484
The generated PHP form code does not properly validate user input folder directories, allowing a remote unauthenticated attacker to perform a path traversal and access arbitrary files on the server.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (4.41%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The generated PHP form code does not properly validate user input folder directories, allowing a remote unauthenticated attacker to perform a path traversal and access arbitrary files on the server. The PHP FormMail Generator website does not use version numbers and is updated continuously. Any PHP form code generated by this website prior to 2016-12-06 may be vulnerable.
- CVSS 3.0
- 7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 4.41% probability · 91th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- jqueryform/php formmail generator
- Source
- cret@cert.org
References
- http://www.securityfocus.com/bid/94778Third Party Advisory, VDB Entry
- https://www.kb.cert.org/vuls/id/494015Third Party Advisory, US Government Resource
- http://www.securityfocus.com/bid/94778Third Party Advisory, VDB Entry
- https://www.kb.cert.org/vuls/id/494015Third Party Advisory, US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.