CVE-2010-10013

AjaXplorer < 2.6 checkInstall.php Unauthenticated RCE

CVSS 9.3 CRITICALEPSS 1.1%CWE-78

Vexday Risk Score

63High priority

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 9.3EPSS 1.1%KEV nãoPoC públicaNuclei —Metasploit simPatch —

Lifecycle

04 Apr 2010Metasploit module available

08 Aug 2025Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

An unauthenticated remote command execution vulnerability exists in AjaXplorer (now known as Pydio Cells) versions prior to 2.6. The flaw resides in the checkInstall.php script within the access.ssh plugin, which fails to properly sanitize user-supplied input to the destServer GET parameter. By injecting shell metacharacters, remote attackers can execute arbitrary system commands on the server with the privileges of the web server process.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected products

AjaXplorer · AjaXplorer

public PoCs found — 2

cve_referenceraw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/ajaxplorer_checkinstall_exec.rbunverified cve_referencewww.exploit-db.com/exploits/21993unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/ajaxplorer_checkinstall_exec.rb https://sourceforge.net/projects/ajaxplorer/https://www.exploit-db.com/exploits/21993 https://www.tenable.com/plugins/nessus/45489 https://www.vulncheck.com/advisories/ajaxplorer-unauth-rce