CVE-2018-6409 | BDVDB-2026-101178 Detail

Description#

An issue was discovered in Appnitro MachForm before 4.2.3. The module in charge of serving stored files gets the path from the database. Modifying the name of the file to serve on the corresponding ap_form table leads to a path traversal vulnerability via the download.php q parameter.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://metalamin.github.io/MachForm-not-0-day-EN/
https://www.exploit-db.com/exploits/44804/
https://www.machform.com/blog-machform-423-security-release/

Exploit#

https://www.exploit-db.com/exploits/44804/

History#

Version 12018-05-26Record published in the CVE List.
Version 22024-08-05Most recent update recorded in the CVE List.