CVE-2012-10042highCWE-434

CVE-2012-10042: fallo de gravedad alta en Sflog! CMS

Sflog! CMS 1.0 Arbitrary File Upload RCE

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Sflog! CMS

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

36Vexday Risk Score

Corrige pronto. Ella tiene exploit funcional público.

ssvc Attendcvss 8.7epss 1.5%
de la publicación al armael mismo día
Publicada en NVD8 ago
metasploit6 jul
Sflog! CMS 1.0 contains an authenticated arbitrary file upload vulnerability in the blog management interface. The application ships with default credentials (admin:secret) and allows authenticated users to upload files via manage.php. The upload mechanism fails to validate file types, enabling attackers to upload a PHP backdoor into a web-accessible directory (blogs/download/uploads/). Once uploaded, the file can be executed remotely, resulting in full remote code execution.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
Sflog! · Sflog! CMS