-
Notifications
You must be signed in to change notification settings - Fork 32
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Pixlogix_Flexibleforms #84
Comments
Pixlogix_Flexibleforms can also be used to inject malicious code into Magento 1 stores, we discovered yesterday. The extension doesn't have any form of protection against unwanted file uploads. A file can be uploaded using the module's submit actions, which will then be stored in media/flexibleforms/files and will become publicly available. The uploaded file we've discovered, contained an |
@JerVoo thanks for confirmation. Which version are you describing? |
Every version to be honest. I discovered the vulnerability in v0.7.0, but the latest version (v1.0.13) has still got the same vulnerability built in. The module doesn't check for allowed file types. In the code there is a reference to a list of allowed file extensions, but it's impossible to define which file extensions are allowed, nor is there a list of allowed extensions defined anywhere in the code. |
Cheers, want to make a PR for M1 ? https://github.com/sansecio/magevulndb/blob/master/magento1-vulnerable-extensions.csv |
FYI we found malicious PHP code in the
media/flexibleforms/files/
on two separate installs, one running2.0.1
(M2) and one running0.5.0
. Should look into the vuln and affected versions (cannot tell if 2.0.1 was compromised or an older version).Edit: we contacted the vendor last month but they did not reply
The text was updated successfully, but these errors were encountered: