CVE-2012-10024

EIP tracks 1 public exploit for CVE-2012-10024. PoCs published by sinn3r, s yaws_traversal exploit as a skeleton, acidgen, ,, hostess, including Metasploit module auxiliary/gather/xbmc_traversal.

AI-analyzed exploit summary This Metasploit module exploits a directory traversal vulnerability in XBMC Web Server (CVE-2012-10024) to retrieve arbitrary files. It uses HTTP GET requests with path traversal sequences and optional authentication.

XBMC version 11.0 contains a path traversal vulnerability in its embedded HTTP server. When accessed via HTTP Basic Authentication, the server fails to properly sanitize URI input, allowing authenticated users to request files outside the intended document root. An attacker can exploit this flaw to read arbitrary files from the host filesystem, including sensitive configuration or credential files.