PT-2019-12065 · WordPress · Ninja Forms

Jasper Weijts · Publicado 2019-05-07 · Atualizado 2022-05-02 · CVE-2019-10869

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ninja Forms plugin versions prior to 3.0.23

Description The issue allows an attacker to traverse the file system and access files, as well as execute code. This is achieved through the includes/fields/upload.php page, specifically via the name and tmp name parameters.

Recommendations For versions prior to 3.0.23, update to version 3.0.23 or later to resolve the issue. As a temporary workaround, consider disabling the Uploads add-on until the update is applied. Restrict access to the includes/fields/upload.php page to minimize the risk of exploitation. Avoid using the name and tmp name parameters in the affected upload/submit page until the issue is resolved.

Exploit

Correção

Unrestricted File Upload

Path traversal

Enumeração de Fraquezas

CWE-434

CWE-22

Identificadores relacionados

CVE-2019-10869

Produtos afetados

Ninja Forms

Referências · 5

• 🔥 https://github.com/KTN1990/CVE-2019-10869 · Exploit
• 🔥 https://onvio.nl/nieuws/ninjaforms-vulnerability · Exploit
• https://osv.dev/vulnerability/CVE-2019-10869 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-10869 · Nota de Segurança
• https://wpvulndb.com/vulnerabilities/9272 · Nota