CVE-2012-10036
BaseFortify
Publication date: 2025-08-08
Last updated on: 2025-08-08
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| project_pier | project_pier | 0.8.8 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Project Pier 0.8.8 and earlier, where an unauthenticated attacker can upload arbitrary files via tools/upload_file.php. The upload handler does not validate the file type or require authentication, allowing attackers to upload malicious PHP files into a web-accessible directory. These files have a predictable suffix and can be executed by accessing their URL, leading to remote code execution.
How can this vulnerability impact me? :
An attacker can exploit this vulnerability to upload and execute malicious PHP code on the affected server without authentication. This can lead to full remote code execution, allowing the attacker to take control of the server, steal data, modify or delete files, and potentially use the server as a pivot point for further attacks.