PT-2013-5297 · Machform · Machform

Yashar Shahinzadeh · Publicado 2013-07-29 · Atualizado 2021-07-01 · CVE-2013-4949

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Machform version 2

Description The issue allows remote attackers to execute arbitrary PHP code by uploading a PHP file to the upload form's directory in data/, then accessing it via a direct request. This is due to an unrestricted file upload vulnerability in view.php.

Recommendations For Machform version 2, consider restricting file uploads to only allowed file types to prevent the execution of arbitrary PHP code. As a temporary workaround, restrict access to the upload form's directory in data/ to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2013-4949

Produtos afetados

Machform

Referências · 6

• 🔥 https://exploit-db.com/exploits/26553 · Exploit
• 🔥 http://exploit-db.com/exploits/26553 · Exploit
• http://osvdb.org/94802 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-4949 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/85386 · Nota
• http://packetstormsecurity.com/files/122255/Machform-Form-Maker-2-XSS-Shell-Upload-SQL-Injection.html · Nota