CVE-2012-10056

PHP Volunteer Management System v1.0.2 contains an arbitrary file upload vulnerability in its document upload functionality. Authenticated users can upload files to the mods/documents/uploads/ directory without any restriction on file type or extension. Because this directory is publicly accessible and lacks execution controls, attackers can upload a malicious PHP payload and execute it remotely. The application ships with default credentials, making exploitation trivial. Once authenticated, the attacker can upload a PHP shell and trigger it via a direct GET request.

CVSS

No CVSS.

References

Link	Resource
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/php_volunteer_upload_exec.rb
https://sourceforge.net/projects/phpvolunteer/
https://www.exploit-db.com/exploits/18941
https://www.exploit-db.com/exploits/18957
https://www.vulncheck.com/advisories/php-volunteer-management-system-arbitrary-file-upload

Configurations

No configuration.

History

14 Aug 2025, 13:11

Type	Values Removed	Values Added
Summary		(es) PHP Volunteer Management System v1.0.2 contiene una vulnerabilidad de carga de archivos arbitraria en su funcionalidad de carga de documentos. Los usuarios autenticados pueden subir archivos al directorio mods/documents/uploads/ sin ninguna restricción de tipo ni extensión. Dado que este directorio es de acceso público y carece de controles de ejecución, los atacantes pueden cargar un payload PHP malicioso y ejecutarlo en remoto. La aplicación se entrega con credenciales predeterminadas, lo que facilita su explotación. Una vez autenticado, el atacante puede cargar un shell PHP y activarlo mediante una solicitud GET directa.

13 Aug 2025, 21:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-08-13 21:15

Updated : 2025-08-14 13:11

NVD link : CVE-2012-10056

Mitre link : CVE-2012-10056

CVE.ORG link : CVE-2012-10056

JSON object : View

Products Affected

No product.

CWE

CWE-434

Unrestricted Upload of File with Dangerous Type

{"id": "CVE-2012-10056", "cveTags": [{"tags": ["unsupported-when-assigned"], "sourceIdentifier": "disclosure@vulncheck.com"}], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-08-13T21:15:29.997", "references": [{"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/php_volunteer_upload_exec.rb", "source": "disclosure@vulncheck.com"}, {"url": "https://sourceforge.net/projects/phpvolunteer/", "source": "disclosure@vulncheck.com"}, {"url": "https://www.exploit-db.com/exploits/18941", "source": "disclosure@vulncheck.com"}, {"url": "https://www.exploit-db.com/exploits/18957", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/php-volunteer-management-system-arbitrary-file-upload", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "PHP Volunteer Management System v1.0.2 contains an arbitrary file upload vulnerability in its document upload functionality. Authenticated users can upload files to the mods/documents/uploads/ directory without any restriction on file type or extension. Because this directory is publicly accessible and lacks execution controls, attackers can upload a malicious PHP payload and execute it remotely. The application ships with default credentials, making exploitation trivial. Once authenticated, the attacker can upload a PHP shell and trigger it via a direct GET request."}, {"lang": "es", "value": "PHP Volunteer Management System v1.0.2 contiene una vulnerabilidad de carga de archivos arbitraria en su funcionalidad de carga de documentos. Los usuarios autenticados pueden subir archivos al directorio mods/documents/uploads/ sin ninguna restricci\u00f3n de tipo ni extensi\u00f3n. Dado que este directorio es de acceso p\u00fablico y carece de controles de ejecuci\u00f3n, los atacantes pueden cargar un payload PHP malicioso y ejecutarlo en remoto. La aplicaci\u00f3n se entrega con credenciales predeterminadas, lo que facilita su explotaci\u00f3n. Una vez autenticado, el atacante puede cargar un shell PHP y activarlo mediante una solicitud GET directa."}], "lastModified": "2025-08-14T13:11:53.633", "sourceIdentifier": "disclosure@vulncheck.com"}