PT-2013-5297 · Machform · Machform

Yashar Shahinzadeh · Published 2013-07-29 · Updated 2021-07-01 · CVE-2013-4949

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Machform version 2

Description The issue allows remote attackers to execute arbitrary PHP code by uploading a PHP file to the upload form's directory in data/, then accessing it via a direct request. This is due to an unrestricted file upload vulnerability in view.php.

Recommendations For Machform version 2, consider restricting file uploads to only allowed file types to prevent the execution of arbitrary PHP code. As a temporary workaround, restrict access to the upload form's directory in data/ to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2013-4949

Affected Products

Machform

References · 6

• 🔥 https://exploit-db.com/exploits/26553 · Exploit
• 🔥 http://exploit-db.com/exploits/26553 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-4949 · Security Note
• http://osvdb.org/94802 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/85386 · Note
• http://packetstormsecurity.com/files/122255/Machform-Form-Maker-2-XSS-Shell-Upload-SQL-Injection.html · Note