CVE-2012-10050 CuteFlow <= 2.11.2 Arbitrary File Upload RCE
CriticalCVSS 9.3
EPSS 2.2%
Framework module
- Published
- Updated
- Exploit status
- Public exploit available
Description
CuteFlow version 2.11.2 and earlier contains an arbitrary file upload vulnerability in the restart_circulation_values_write.php script. The application fails to validate or restrict uploaded file types, allowing unauthenticated attackers to upload arbitrary PHP files to the upload/___1/ directory. These files are then accessible via the web server, enabling remote code execution.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| CuteFlow.org CuteFlow | <= 2.11.2 | No fix listed |
References
- web.archive.org product
- raw.githubusercontent.com exploit
- www.exploit-db.com exploit
- web.archive.org exploit technical-description
- sourceforge.net product
- www.vulncheck.com third-party-advisory