[原文]The check_referer() function in Formmail.php 5.0 and earlier allows remote attackers to bypass access restrictions via an empty or spoofed HTTP Referer, as demonstrated using an application on the same web server that contains a cross-site scripting (XSS) issue.
Jack's FormMail.php contains a flaw that may allow a malicious user to upload arbitrary files, due to an absence of validation in the 'check_referer()' function. It is possible that the flaw may allow execution of arbitrary code in uploaded files resulting in a loss of confidentiality, integrity, and/or availability.
Currently, there are no known upgrades or patches to correct this issue. It is possible to correct the flaw by implementing the following workaround(s):
Write protect all public folders to ensure that files can only be written to a dedicated and protected upload folder.
The disclosure of this issue has been credited to Himeur Nourredine <firstname.lastname@example.org>.
Joe Lumbroso Jack's FormMail.php 5.0
Joe Lumbroso Jack's FormMail.php 2.0
It has been reported that Jack's Formmail.php may be prone to an unauthorized file upload vulnerability that may allow a remote attacker to gain unauthorized access to a vulnerable server and upload arbitrary files. Due to improper validation performed in the 'check_referer()' function, an attacker can bypass the checks by supplying an empty value for HTTP referer. This issue may then allow an attacker to upload a file via the 'css' variable of 'file.php' script.
Although unconfirmed, Formmail.php versions 5.0 and prior may be affected by this issue.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: email@example.com <mailto:firstname.lastname@example.org>.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: email@example.com <mailto:firstname.lastname@example.org>.