PHP forms generated using the PHP FormMail Generator are vulnerable to unrestricted upload of dangerous file types

The code generated by PHP FormMail Generator prior to 17 December 2016 is vulnerable to unrestricted upload of dangerous file types. In the generated form.lib.php file, upload file types are checked against a hard-coded list of dangerous extensions. This list does not include all variations of PHP files, which may lead to execution of the contained PHP code if the attacker can guess the uploaded filename. The form by default appends a short random string to the end of the filename.

N/A

危险类型文件的不加限制上传

PHP FormMail Generator 安全漏洞

PHP FormMail Generator是一套使用于生成包含在PHP或WordPress网站中的标准Web表单的PHP应用程序。 PHP FormMail Generator（2016年12月7日之前发布的版本）中所生成的代码存在安全漏洞，该漏洞源于程序根据硬编码的危险扩展名列表来检查上传的文件类型。远程攻击者可利用该漏洞执行PHP代码。

N/A

N/A