JVNDB-2009-000014

MP Form Mail CGI vulnerability allows third party to gain administrative privileges

MP Form Mail CGI from futomi's CGI Cafe contains a vulnerability that allows an attacker to gain administrative privileges.

MP Form Mail CGI from futomi's CGI Cafe is a software for sending contents entered into an HTML form via email. MP Form Mail CGI contains a vulnerability that allows an attacker to gain administrative privileges.

Base Metrics: 7.5 (High) [IPA Score]

• Access Vector: Network
• Access Complexity: Low
• Authentication: None
• Confidentiality Impact: Partial
• Integrity Impact: Partial
• Availability Impact: Partial

futomi Co.,Ltd.

• MP Form Mail CGI eCommerce Edition Ver 1.3.0 and earlier
• MP Form Mail CGI Professional Edition Ver 3.2.2 and earlier

A remote attacker could impersonate an administrator of MP Form Mail CGI.

[Update the Software]
Update to the latest version according to the information provided by the vendor.

[Workarounds]
As a workaround to this vulnerability, change the settings in the server where the software is installed and disable access to the administrator menu until the software is updated.

futomi Co.,Ltd.

• futomi's CGI Cafe : New versions of MP Form Mail CGI eCommerce and Standard Editions (Japanese Only)

1. JVN : JVN#84899898
2. National Vulnerability Database (NVD) : CVE-2009-0962
3. Common Vulnerabilities and Exposures (CVE) : CVE-2009-0962
4. Common Weakness Enumeration (CWE) : Credentials Management (CWE-255) [IPA Evaluation]
5. JVN iPedia (Japanese) : JVNDB-2009-000014

[2009/03/13]
  Web page published