CVE-2012-10044
CRITICALMobileCartly 1.0 - Unauthenticated Arbitrary File Creation via savepage.php
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2012-10044.
PoCs published by Metasploit, Yakir Wizman, including Metasploit module exploits/multi/http/mobilecartly_upload_exec.
AI-analyzed exploit summary This Metasploit module exploits an arbitrary file creation vulnerability in MobileCartly 1.0 via the savepage.php file, which lacks permission checks. It allows attackers to write PHP payloads to the server and execute them, achieving remote code execution (RCE).
Description
MobileCartly version 1.0 contains an arbitrary file creation vulnerability in the savepage.php script. The application fails to perform authentication or authorization checks before invoking file_put_contents() on attacker-controlled input. An unauthenticated attacker can exploit this flaw by sending crafted HTTP GET requests to savepage.php, specifying both the filename and content. This allows arbitrary file creation within the pages/ directory or any writable path on the server, allowing remote code execution.
Exploits (3)
This Metasploit module exploits an arbitrary file creation vulnerability in MobileCartly 1.0 via the savepage.php file, which lacks permission checks. It allows attackers to write PHP payloads to the server and execute them, achieving remote code execution (RCE).
This exploit demonstrates an arbitrary file write vulnerability in MobileCartly 1.0, allowing an attacker to write malicious PHP code to a file via the 'savepage.php' endpoint. The PoC includes a simple command execution payload to achieve remote code execution (RCE).
This Metasploit module exploits an arbitrary file creation vulnerability in MobileCartly 1.0 via the savepage.php file, which allows unauthenticated users to write PHP payloads to the server and achieve remote code execution.
References (5)
Scores
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H