PT-2011-1973 · Groone · Groone'S Simple Contact Form

Eidelweiss · Publicado 2011-11-02 · Atualizado 2018-10-10 · CVE-2010-5038

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Groone's Simple Contact Form (affected versions not specified)

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter in the contact/contact.php file.

Recommendations For Groone's Simple Contact Form, consider restricting access to the contact/contact.php file until a patch is available. As a temporary workaround, avoid using the abspath parameter in the affected file to minimize the risk of exploitation.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2010-5038

Produtos afetados

Groone'S Simple Contact Form

Referências · 5

• 🔥 http://packetstormsecurity.org/1005-exploits/groonescf-rfi.txt · Exploit
• http://securityfocus.com/archive/1/511551/100/0/threaded · Nota
• http://vupen.com/english/advisories/2010/1291 · Aviso do Fabricante
• http://securityreason.com/securityalert/8523 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-5038 · Nota de Segurança