CVE-2012-10038
CRITICALAuxilium RateMyPet - Unauthenticated Arbitrary File Upload via Banner Upload Feature
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2012-10038.
PoCs published by Metasploit, DaOne, DaOne, sinn3r, including Metasploit module exploits/multi/http/auxilium_upload_exec.
AI-analyzed exploit summary This Metasploit module exploits an arbitrary file upload vulnerability in Auxilium RateMyPet's banner upload feature, allowing remote code execution via PHP or Linux payloads.
Description
Auxilium RateMyPet contains an unauthenticated arbitrary file upload vulnerability in upload_banners.php. The banner upload feature fails to validate file types or enforce authentication, allowing remote attackers to upload malicious PHP files. These files are stored in a web-accessible /banners/ directory and can be executed directly, resulting in remote code execution.
Exploits (3)
This Metasploit module exploits an arbitrary file upload vulnerability in Auxilium RateMyPet's banner upload feature, allowing remote code execution via PHP or Linux payloads.
This exploit demonstrates multiple vulnerabilities in Auxilium PetRatePro, including unauthenticated admin creation, SQL injection, and remote file upload. The PoC provides direct HTTP requests and forms to exploit these issues.
This Metasploit module exploits an arbitrary file upload vulnerability in Auxilium RateMyPet, allowing remote code execution by uploading a malicious PHP file via the banner upload feature.
References (4)
Scores
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N