CVE-2012-10045
XODA 0.4.5 Arbitrary PHP File Upload
Vexday Risk Score
63Prioridad alta
Decisión SSVC (CISA)
Attend
PoC disponible → seguir de cerca
CVSS 9.3EPSS 1.1%KEV nãoPoC públicaNuclei —Metasploit simPatch —
Ciclo de vida
21 ago 2012Exploit Metasploit disponible
08 ago 2025Publicada en NVD
Recomendación: Planificar corrección próxima — ya existe PoC pública.
XODA version 0.4.5 contains an unauthenticated file upload vulnerability that allows remote attackers to execute arbitrary PHP code on the server. The flaw resides in the upload functionality, which fails to properly validate or restrict uploaded file types. By crafting a multipart/form-data POST request, an attacker can upload a .php file directly into the web-accessible files/ directory and trigger its execution via a subsequent GET request.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
XODA · XODAPoCs públicas encontradas — 3
cve_referenceraw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/xoda_file_upload.rbno verificadocve_referencewww.exploit-db.com/exploits/20703no verificadocve_referencewww.exploit-db.com/exploits/20713no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →Referencias
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/xoda_file_upload.rbhttps://sourceforge.net/projects/xoda/https://www.exploit-db.com/exploits/20703https://www.exploit-db.com/exploits/20713https://www.vulncheck.com/advisories/xoda-arbitrary-php-file-uploadhttps://xoda.org/