PT-2018-5072 · Php · Php Formmail Generator

Pouya Darabi · Publicado 2018-07-13 · Atualizado 2019-10-09 · CVE-2016-9482

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP FormMail Generator (affected versions not specified)

Description The issue allows a remote unauthenticated user to bypass authentication and access the administrator panel. This can be achieved by navigating directly to the "/admin.php?mod=admin&func=panel" API endpoint.

Recommendations As a temporary workaround, consider disabling access to the /admin.php API endpoint until a patch is available. Restrict access to the administrator panel to minimize the risk of exploitation. Avoid using the mod and func parameters in the affected API endpoint until the issue is resolved.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-302

CWE-287

Identificadores relacionados

CVE-2016-9482

Produtos afetados

Php Formmail Generator

Referências · 3

• https://kb.cert.org/vuls/id/494015 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-9482 · Nota de Segurança
• http://securityfocus.com/bid/94778 · Nota