CVE-2012-10038 Auxilium RateMyPet Arbitrary File Upload RCE

CriticalCVSS 9.3 EPSS 1.8% Framework module

Published: 2025-08-11 17:54
Updated: 2026-06-17 02:38
Exploit status: Public exploit available

Description

Auxilium RateMyPet contains an unauthenticated arbitrary file upload vulnerability in upload_banners.php. The banner upload feature fails to validate file types or enforce authentication, allowing remote attackers to upload malicious PHP files. These files are stored in a web-accessible /banners/ directory and can be executed directly, resulting in remote code execution.

Affected products

Product	Affected versions	Fixed in
Auxilium RateMyPet	All versions	No fix listed

References

CVSS v4.0

9.3 Critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: None
User Interaction: None
Vulnerable System Confidentiality: High
Vulnerable System Integrity: High
Vulnerable System Availability: High
Subsequent System Confidentiality: None
Subsequent System Integrity: None
Subsequent System Availability: None

All scores (2)

v4.0 9.3 · vulncheck
v4.0 9.3 · disclosure@vulncheck.com

Weakness & likelihood

EPSS (exploitation probability, 30 days): 1.85% (percentile 79.4)
CWE: CWE-434 Unrestricted Upload of File with Dangerous Type

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

Auxilium RateMyPet Arbitrary File Upload Vulnerability Framework module · Metasploit Framework (Rapid7) · 2012-09-14