PT-2019-12400 · 10Web · 10Web Form Maker
Neven Biruski
·
Publicado
2019-04-29
·
Atualizado
2020-08-24
·
CVE-2019-11590
CVSS v3.1
8.8
Alta
| Vetor | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
10Web Form Maker plugin versions prior to 1.13.5
Description
The issue allows for CSRF via the "wp-admin/admin-ajax.php" action parameter, potentially leading to local file inclusion through directory traversal. This is due to a discrepancy between the
$ POST['action'] value and the $ GET['action'] value, where the latter is unsanitized.Recommendations
For versions prior to 1.13.5, update to version 1.13.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the "wp-admin/admin-ajax.php" endpoint to minimize the risk of exploitation. Avoid using unsanitized
$ GET['action'] values in the affected endpoint until the issue is resolved.Exploit
Correção
CSRF
Path traversal
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
10Web Form Maker