PT-2019-12400 · 10Web · 10Web Form Maker

Neven Biruski · Published 2019-04-29 · Updated 2020-08-24 · CVE-2019-11590

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions 10Web Form Maker plugin versions prior to 1.13.5

Description The issue allows for CSRF via the "wp-admin/admin-ajax.php" action parameter, potentially leading to local file inclusion through directory traversal. This is due to a discrepancy between the $ POST['action'] value and the $ GET['action'] value, where the latter is unsanitized.

Recommendations For versions prior to 1.13.5, update to version 1.13.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the "wp-admin/admin-ajax.php" endpoint to minimize the risk of exploitation. Avoid using unsanitized $ GET['action'] values in the affected endpoint until the issue is resolved.

Exploit

Fix

CSRF

Path traversal

Weakness Enumeration

CWE-352

CWE-829

CWE-22

Related Identifiers

CVE-2019-11590

Affected Products

10Web Form Maker

References · 5

• 🔥 http://seclists.org/fulldisclosure/2019/Apr/36 · Exploit
• 🔥 https://lists.openwall.net/full-disclosure/2019/04/05/11 · Exploit
• https://osv.dev/vulnerability/CVE-2019-11590 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11590 · Security Note
• https://wordpress.org/plugins/form-maker/#developers · Note