PT-2024-38576 · Bit Form · The Contact Form By Bit Form

Siunam + 1 · Published 2024-08-19 · Updated 2024-08-26 · CVE-2024-7782

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Contact Form by Bit Form versions 2.0 through 2.13.4

Description The issue is related to insufficient file path validation in the iconRemove function, which allows authenticated attackers with Administrator-level access and above to delete arbitrary files on the server. This can lead to remote code execution when specific files, such as wp-config.php, are deleted.

Recommendations For versions 2.0 through 2.13.4, consider disabling the iconRemove function until a patch is available to prevent arbitrary file deletion. Restrict access to sensitive files on the server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-7782

Affected Products

The Contact Form By Bit Form

References · 11

• https://osv.dev/vulnerability/CVE-2024-7782 · Vendor Advisory
• https://plugins.trac.wordpress.org/browser/bit-form/tags/2.13.0/includes/Admin/AdminAjax.php#L1271 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-7782 · Security Note
• https://t.me/cvenotify/91229 · Telegram Post
• https://t.me/cvenotify/92204 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1825769561381130491 · Twitter Post
• https://twitter.com/cracbot/status/1827224473340432407 · Twitter Post
• https://twitter.com/CveFindCom/status/1826809309419680060 · Twitter Post
• https://twitter.com/siunam321/status/1826899321314574769 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/d4da8ead-326f-4c93-b56d-8bfa643d7906?source=cve · Note
• https://t.me/cvedetector/3593 · Telegram Post