PT-2018-5082 · Php · Php Formmail Generator

Ibram Marzouk · Published 2018-07-13 · Updated 2019-10-09 · CVE-2016-9492

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PHP FormMail Generator versions prior to 17 December 2016

Description The issue concerns the unrestricted upload of dangerous file types. In the generated form.lib.php file, upload file types are checked against a hard-coded list of dangerous extensions. However, this list does not include all variations of PHP files, which may lead to execution of the contained PHP code if the attacker can guess the uploaded filename. The form by default appends a short random string to the end of the filename.

Recommendations For versions prior to 17 December 2016, consider updating the form.lib.php file to include all variations of PHP files in the list of dangerous extensions to prevent the upload of malicious PHP files. As a temporary workaround, consider restricting the upload of files with PHP extensions or disabling the file upload feature until a proper fix is applied.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2016-9492

Affected Products

Php Formmail Generator

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-9492 · Security Note
• https://osv.dev/vulnerability/CVE-2016-9492 · Vendor Advisory
• http://securityfocus.com/bid/96718 · Note
• https://kb.cert.org/vuls/id/608591 · Note