PT-2024-38571 · Bit Form · The Contact Form By Bit Form

Siunam + 1 · Published 2024-08-19 · Updated 2024-08-26 · CVE-2024-7775

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Contact Form by Bit Form versions 2.0 through 2.13.9

Description The issue is related to arbitrary JavaScript file uploads due to missing input validation in the addCustomCode function. This allows authenticated attackers with Administrator-level access and above to upload arbitrary JavaScript files to the affected site's server.

Recommendations For versions 2.0 through 2.13.9, consider disabling the addCustomCode function until a patch is available to prevent arbitrary JavaScript file uploads. Restrict access to the plugin's custom code feature to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-7775

Affected Products

The Contact Form By Bit Form

References · 9

• https://plugins.trac.wordpress.org/browser/bit-form/tags/2.13.6/includes/Admin/AdminAjax.php#L1314 · Patch
• https://osv.dev/vulnerability/CVE-2024-7775 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7775 · Security Note
• https://t.me/cvedetector/3594 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/3936d7dc-840e-41fc-8af4-db40c0cff660?source=cve · Note
• https://t.me/cvenotify/92201 · Telegram Post
• https://twitter.com/siunam321/status/1826899321314574769 · Twitter Post
• https://t.me/cvenotify/91226 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1825770317823848593 · Twitter Post