CVE-2012-10037 PhpTax pfilez Parameter Exec Remote Code Injection
CriticalCVSS 9.3
EPSS 1.9%
Framework module
- Published
- Updated
- Exploit status
- Public exploit available
Description
PhpTax version 0.8 contains a remote code execution vulnerability in drawimage.php. The pfilez GET parameter is unsafely passed to the exec() function without sanitization. A remote attacker can inject arbitrary shell commands, leading to code execution under the web server's context. No authentication is required.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| PhpTax | = 0.8 | No fix listed |
References
- raw.githubusercontent.com exploit
- www.exploit-db.com exploit
- www.exploit-db.com exploit
- sourceforge.net product