CVSS: 5.3EPSS: 6%CPEs: 1EXPL: 3CVE-2020-9364 – Creative Contact Form 4.6.2 Directory Traversal
https://notcve.org/view.php?id=CVE-2020-9364
An issue was discovered in helpers/mailer.php in the Creative Contact Form extension 4.6.2 before 2019-12-03 for Joomla!. A directory traversal vulnerability resides in the filename field for uploaded attachments via the creativecontactform_upload parameter. An attacker could exploit this vulnerability with the "Send me a copy" option to receive any files of the filesystem via email. Se detectó un problema en el archivo helpers/mailer.php en la extension Creative Contact Form versiones anteriores a 4.6.2 hasta el 2019-12-03 para Joomla!. Una vulnerabilidad de salto de directorio reside en el campo filename para los archivos adjuntos cargados por medio del parámetro creativecontactform_upload. • http://packetstormsecurity.com/files/156655/Creative-Contact-Form-4.6.2-Directory-Traversal.html http://seclists.org/fulldisclosure/2020/Mar/13 https://extensions.joomla.org/extension/creative-contact-form https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories/ait-sa-20200301-01 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 92%CPEs: 3EXPL: 2CVE-2014-8739 – Creative Contact Form < 1.0.0 - Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2014-8739
Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form (formerly Sexy Contact Form) before 1.0.0 for WordPress and before 2.0.1 for Joomla!, allows remote attackers to execute arbitrary code by uploading a PHP file with an PHP extension, then accessing it via a direct request to the file in files/, as exploited in the wild in October 2014. Una vulnerabilidad de carga de archivos sin restricciones en el archivo server/php/UploadHandler.php en el jQuery File Upload Plugin versión 6.4.4 para jQuery, como es usado en el Creative Solutions Creative Contact Form (anteriormente Sexy Contact Form) versiones anteriores a 1.0.0 para WordPress, y versiones anteriores a 2.0.1 para Joomla!, permite a atacantes remotos ejecutar código arbitrario mediante la carga de un archivo PHP con una extensión PHP, y luego acceder a él mediante una petición directa al archivo en files/, como se explotó "in the wild" en octubre de 2014. • https://www.exploit-db.com/exploits/36811 https://www.exploit-db.com/exploits/35057 http://osvdb.org/show/osvdb/113669 http://osvdb.org/show/osvdb/113673 http://www.openwall.com/lists/oss-security/2014/11/11/4 http://www.openwall.com/lists/oss-security/2014/11/11/5 http://www.openwall.com/lists/oss-security/2014/11/13/3 https://wordpress.org/plugins/sexy-contact-form/changelog • CWE-434: Unrestricted Upload of File with Dangerous Type •