CVE-2024-6937: formtools.org Form Tools Import Option List edit.php curl_exec file inclusion
First published: Sun Jul 21 2024(Updated: )
A vulnerability, which was classified as problematic, was found in formtools.org Form Tools 3.1.1. Affected is the function curl_exec of the file /admin/forms/option_lists/edit.php of the component Import Option List. The manipulation of the argument url leads to file inclusion. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-271992. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Credit: cna@vuldb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| MooTools | =3.1.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-6937?
CVE-2024-6937 is classified as problematic, indicating significant security risks.
How does CVE-2024-6937 affect Form Tools 3.1.1?
CVE-2024-6937 affects Form Tools 3.1.1 through a vulnerability in the curl_exec function that allows for file inclusion.
How do I fix CVE-2024-6937?
To fix CVE-2024-6937, update Form Tools to a patched version released after 3.1.1.
What type of attack is enabled by CVE-2024-6937?
CVE-2024-6937 enables attackers to exploit file inclusion vulnerabilities.
Are there any workarounds for CVE-2024-6937?
Temporary workarounds for CVE-2024-6937 include disabling the affected functionality until a permanent fix is applied.
- agent/weakness
- agent/title
- agent/references
- agent/first-publish-date
- agent/description
- agent/type
- agent/severity
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/formtools
- canonical/mootools
- version/mootools/3.1.1