PT-2019-12065 · WordPress · Ninja Forms

Jasper Weijts · Published 2019-05-07 · Updated 2022-05-02 · CVE-2019-10869

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ninja Forms plugin versions prior to 3.0.23

Description The issue allows an attacker to traverse the file system and access files, as well as execute code. This is achieved through the includes/fields/upload.php page, specifically via the name and tmp name parameters.

Recommendations For versions prior to 3.0.23, update to version 3.0.23 or later to resolve the issue. As a temporary workaround, consider disabling the Uploads add-on until the update is applied. Restrict access to the includes/fields/upload.php page to minimize the risk of exploitation. Avoid using the name and tmp name parameters in the affected upload/submit page until the issue is resolved.

Exploit

Fix

Unrestricted File Upload

Path traversal

Weakness Enumeration

CWE-434

CWE-22

Related Identifiers

CVE-2019-10869

Affected Products

Ninja Forms

References · 5

• 🔥 https://github.com/KTN1990/CVE-2019-10869 · Exploit
• 🔥 https://onvio.nl/nieuws/ninjaforms-vulnerability · Exploit
• https://osv.dev/vulnerability/CVE-2019-10869 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10869 · Security Note
• https://wpvulndb.com/vulnerabilities/9272 · Note