search menu icon-carat-right cmu-wordmark

CERT Coordination Center


PHP FormMail Generator generates code with multiple vulnerabilities

Vulnerability Note VU#494015

Original Release Date: 2016-12-08 | Last Revised: 2016-12-08

Overview

PHP FormMail Generator is a single-instance website that generates PHP code for standard web forms for inclusion into PHP or WordPress websites. The generated code is vulnerable to authentication bypass and unsafe deserialization of untrusted data.

Description

CWE-302: Authentication Bypass by Assumed-Immutable Data - CVE-2016-9482

A remote unauthenticated user may bypass authentication to access the administrator panel by navigating directly to:

/admin.php?mod=admin&func=panel


CWE-502: Deserialization of Untrusted Data - CVE-2016-9483

The generated PHP form code deserializes untrusted input as part of the phpfmg_filman_download() function. A remote unauthenticated attacker may be able to use this vulnerability to inject PHP code, or along with CVE-2016-9484 (below) to perform local file inclusion attacks and obtain files from the server.

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') - CVE-2016-9484

The generated PHP form code does not properly validate user input folder directories, allowing a remote unauthenticated attacker to perform a path traversal and access arbitrary files on the server.

The PHP FormMail Generator website does not use version numbers and is updated continuously. Any PHP form code generated by this website prior to 2016-12-06 may be vulnerable.

Impact

An unauthenticated remote user may be able to gain access to the form's administrator panel, or obtain files from the server.

Solution

Regenerate your PHP form code

The PHP FormMail Generator website as of 2016-12-06 generates PHP code that addresses these issues. Affected users are encouraged to regenerate the PHP form code using the website, or manually apply patches.

Vendor Information

494015
Expand all

PHP FormMail Generator

Notified:  November 29, 2016 Updated:  December 08, 2016

Statement Date:   December 01, 2016

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The PHP code generated as of 20161206 addresses the vulnerabilities reported.

Vendor References

http://www.formmail-maker.com/generator.php

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C
Temporal 10.0 E:ND/RL:ND/RC:ND
Environmental 7.5 CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References

Credit

Thanks to Pouya Darabi for reporting this vulnerability.

This document was written by Garret Wassermann.

Other Information

CVE IDs: CVE-2016-9482, CVE-2016-9483, CVE-2016-9484
Date Public: 2016-12-05
Date First Published: 2016-12-08
Date Last Updated: 2016-12-08 18:24 UTC
Document Revision: 29

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.