CVE-2016-9483

Published: Jul 13, 2018Modified: Nov 21, 2024

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

The PHP form code generated by PHP FormMail Generator deserializes untrusted input as part of the phpfmg_filman_download() function. A remote unauthenticated attacker may be able to use this vulnerability to inject PHP code, or along with CVE-2016-9484 to perform local file inclusion attacks and obtain files from the server.

Affected (1)

Products: Jqueryform: Php Formmail Generator

1 product

Php Formmail Generator

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Jqueryform Php Formmail Generator	All versions

Related CWEs

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (4)

http://www.securityfocus.com/bid/94778

Source: cret@cert.org

Third Party AdvisoryVDB Entry

https://www.kb.cert.org/vuls/id/494015

Source: cret@cert.org

Third Party AdvisoryUS Government Resource

http://www.securityfocus.com/bid/94778

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://www.kb.cert.org/vuls/id/494015

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

Timeline

No history available yet.