CVE-2012-10045
BaseFortify
Publication date: 2025-08-08
Last updated on: 2025-08-08
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| xoda | xoda | 0.4.5 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in XODA version 0.4.5 and allows unauthenticated remote attackers to upload arbitrary PHP files to the server. The upload functionality does not properly validate or restrict the types of files that can be uploaded. An attacker can send a specially crafted multipart/form-data POST request to upload a .php file into a web-accessible directory and then execute that file by making a subsequent GET request, leading to remote code execution on the server.
How can this vulnerability impact me? :
This vulnerability can have severe impacts including allowing attackers to execute arbitrary PHP code on the affected server without authentication. This can lead to full compromise of the server, unauthorized access to sensitive data, defacement, data loss, or use of the server as a launch point for further attacks.