CVE-2012-10036 Project Pier <= 0.8.8 Arbitrary File Upload RCE

CriticalCVSS 9.3 EPSS 2.0% Framework module

Published: 2025-08-08 21:12
Updated: 2026-06-17 02:38
Exploit status: Public exploit available

Description

Project Pier 0.8.8 and earlier contains an unauthenticated arbitrary file upload vulnerability in tools/upload_file.php. The upload handler fails to validate the file type or enforce authentication, allowing remote attackers to upload malicious PHP files directly into a web-accessible directory. The uploaded file is stored with a predictable suffix and can be executed by requesting its URL, resulting in remote code execution.

Affected products

Product	Affected versions	Fixed in
projectpier	<= 0.8.8	No fix listed

References

CVSS v4.0

9.3 Critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: None
User Interaction: None
Vulnerable System Confidentiality: High
Vulnerable System Integrity: High
Vulnerable System Availability: High
Subsequent System Confidentiality: None
Subsequent System Integrity: None
Subsequent System Availability: None

All scores (2)

v4.0 9.3 · vulncheck
v4.0 9.3 · disclosure@vulncheck.com

Weakness & likelihood

EPSS (exploitation probability, 30 days): 2.01% (percentile 81.1)
CWE: CWE-434 Unrestricted Upload of File with Dangerous Type

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

Project Pier Arbitrary File Upload Vulnerability Framework module · Metasploit Framework (Rapid7) · 2012-10-08