PT-2017-7561 · Codepeople · Cp Contact Form With Paypal

Christian Mondragon + 2 · Published 2017-09-29 · Updated 2020-07-29 · CVE-2015-9233

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions cp-contact-form-with-paypal versions prior to 1.1.6

Description The issue is related to CSRF with resultant XSS. It is connected to the files cp contactformpp.php and cp contactformpp admin int list.inc.php.

Recommendations For versions prior to 1.1.6, update to version 1.1.6 or later to resolve the issue.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2015-9233

Affected Products

Cp Contact Form With Paypal

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2015-9233 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9233 · Note
• http://seclists.org/fulldisclosure/2015/Jul/49 · Note
• https://wordpress.org/plugins/cp-contact-form-with-paypal/#developers · Note
• http://seclists.org/oss-sec/2015/q3/88 · Note