CVE-2012-10045: fallo crítico en XODA
XODA 0.4.5 Arbitrary PHP File Upload
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
63Vexday Risk Score
Corrige pronto. Ella tiene exploit funcional público.
ssvc Attendcvss 9.3epss 1.8%
de la publicación al armael mismo día
Publicada en NVD8 ago
metasploit21 ago
XODA version 0.4.5 contains an unauthenticated file upload vulnerability that allows remote attackers to execute arbitrary PHP code on the server. The flaw resides in the upload functionality, which fails to properly validate or restrict uploaded file types. By crafting a multipart/form-data POST request, an attacker can upload a .php file directly into the web-accessible files/ directory and trigger its execution via a subsequent GET request.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
XODA · XODAPoCs públicas encontradas — 3
cve_referenceraw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/xoda_file_upload.rbno verificadocve_referencewww.exploit-db.com/exploits/20703no verificadocve_referencewww.exploit-db.com/exploits/20713no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
Referencias
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/xoda_file_upload.rbhttps://sourceforge.net/projects/xoda/https://www.exploit-db.com/exploits/20703https://www.exploit-db.com/exploits/20713https://www.vulncheck.com/advisories/xoda-arbitrary-php-file-uploadhttps://xoda.org/