CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Unrestricted Upload of File with Dangerous Type vulnerability in RainbowLink Inc. All Post Contact Form allpost-contactform allows Upload a Web Shell to a Web Server.This issue affects All Post Contact Form: from n/a through <= 1.8.2.
Explanation of Vulnerability in Simple Terms
All Post Contact Form versions 1.8.2 and earlier allow unauthenticated attackers to upload arbitrary files to the site without restriction. An attacker can upload malicious files—such as PHP scripts—directly over the network, gaining the ability to run their own code on the site and take full control. No user interaction or special privileges are required.
What an attacker can do
Upload arbitrary files and run malicious code on the site without authentication.
Potential impact on your site
Complete site compromise: attackers can execute code, steal data, modify content, and disable the site.
Conditions required to exploit
Network access only; no authentication, user interaction, or special privileges required.
Key dates
External resources
Related vulnerabilities
