PT-2011-1973 · Groone · Groone'S Simple Contact Form

Eidelweiss · Published 2011-11-02 · Updated 2018-10-10 · CVE-2010-5038

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Groone's Simple Contact Form (affected versions not specified)

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter in the contact/contact.php file.

Recommendations For Groone's Simple Contact Form, consider restricting access to the contact/contact.php file until a patch is available. As a temporary workaround, avoid using the abspath parameter in the affected file to minimize the risk of exploitation.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2010-5038

Affected Products

Groone'S Simple Contact Form

References · 5

• 🔥 http://packetstormsecurity.org/1005-exploits/groonescf-rfi.txt · Exploit
• http://vupen.com/english/advisories/2010/1291 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-5038 · Security Note
• http://securityfocus.com/archive/1/511551/100/0/threaded · Note
• http://securityreason.com/securityalert/8523 · Note