CVE-2012-10049 WebPageTest Arbitrary PHP File Upload RCE
CriticalCVSS 9.3
EPSS 1.9%
Framework module
- Published
- Updated
- Exploit status
- Public exploit available
Description
WebPageTest version 2.6 and earlier contains an arbitrary file upload vulnerability in the resultimage.php script. The application fails to validate or sanitize user-supplied input before saving uploaded files to a publicly accessible directory. This flaw allows remote attackers to upload and execute arbitrary PHP code, resulting in full remote code execution under the web server context.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| WPO Foundation WebPageTest | <= 2.6 | No fix listed |
References
- raw.githubusercontent.com exploit
- www.exploit-db.com exploit
- www.exploit-db.com exploit
- www.broadcom.com third-party-advisory
- github.com product
- www.vulncheck.com third-party-advisory