by Kastro
Paper/Archive/CVE-2024-5085

CVE-2024-5085

hashthemes Hash Form – Drag & Drop Form Builder — Hash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated PHP Object Injection

EPSS 0.8%CVSS 9.8
critical.is priorityof 100
41
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 55.9.559 × 2011.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.0 via deserialization of untrusted input in the 'process_entry' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

Affected

ProductAffectedFixed inSource
Hash Form – Drag & Drop Form Builder≤ 1.1.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Wordfence (CNA)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refwordfence.com/threat-intel/vulnerabilities/id/0166a2b2-24e2-4dd6-8842-d3e8dd7bb0dc?source=cverefplugins.trac.wordpress.org/browser/hash-form/trunk/admin/classes/HashFormEntry.php#L353refplugins.trac.wordpress.org/changeset/3090341