CVE-2016-9492
Critical
Description
The code generated by PHP FormMail Generator prior to 17 December 2016 is vulnerable to unrestricted upload of dangerous file types. In the generated form.lib.php file, upload file types are checked against a hard-coded list of dangerous extensions. This list does not include all variations of PHP files, which may lead to execution of the contained PHP code if the attacker can guess the uploaded filename. The form by default appends a short random string to the end of the filename.
SeverityCritical
CVSS9.8
Exploit probability—
ProductJqueryform Php Formmail Generator
PublishedJul 13, 2018
First seenJul 13, 2018
Weakness typeCWE-434Unrestricted upload of dangerous file type
How to fix
Update
- jqueryform php_formmail_generator2016-12-17 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jqueryform php_formmail_generator | v < 2016-12-17 | 2016-12-17 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.