karlemilnikka/cve-2024-0710Unauthenticated Form Submission Unique ID Modification
An unauthenticated form submitter can choose a custom value for a field that is supposed to always have a random or sequential value. This vulnerability only affects sites where the value must be either random or sequential for legal, functional or security reasons.
GP Unique ID is an addon for Gravity Forms. It assigns unique IDs to entries after successful submission. In contrast to the entries’ actual database IDs, the GP Unique IDs, hereafter called GPUIDs, can be customized by the form creator to follow a specific syntax with defined starting number, character set, length, prefix, and suffix. The GPUID is stored in a custom Gravity Forms entry field. The field is hidden on the frontend.
The plugin developer lists the following common use cases for GP Unique ID.
GP Unique ID assigns the GPUID after the form has been successfully submitted, but only as long as there isn’t a value in the field already. This allows a form submitter to set a custom GPUID when submitting the form. Since the field isn’t empty, no real GPUID gets stored. A visitor can therefore
Gravity Wiz released a patched version of the plugin on 2024-04-09. Site administrators should update to the patched version (1.5.6) and, if relevant, make sure the previous submissions haven’t been tampered with.
