Command Injection Vulnerability in Supsystic Contact Form by Supsystic
CVE-2024-48042

9.1CRITICAL

Key Information:

Vendor

Supsystic

Status
Contact Form By Supsystic
Vendor
CVE Published:
16 October 2024

What is CVE-2024-48042?

Supsystic Contact Form by Supsystic is vulnerable to Command Injection due to improper handling of special elements in its template engine. This vulnerability allows attackers to execute arbitrary commands, potentially compromising the integrity and security of the web application. It affects all versions up to 1.7.28, emphasizing the need for users to update to secure their installations effectively.

Affected Version(s)

Contact Form by Supsystic 0 <= 1.7.28

References

https://patchstack.com/database/Wordpress/Plugin/contact-...
vdb-entry

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

.