CVE-2012-10049
CRITICALWebPageTest < 2.6 - Remote Code Execution via Unrestricted File Upload in resultimage.php
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2012-10049.
PoCs published by Metasploit, dun, dun, sinn3r, including Metasploit module exploits/multi/http/webpagetest_upload_exec.
AI-analyzed exploit summary This Metasploit module exploits an arbitrary PHP file upload vulnerability in WebPageTest v2.6 or older. It uploads a malicious PHP file via the resultimage.php endpoint and executes it to achieve remote code execution.
Description
WebPageTest version 2.6 and earlier contains an arbitrary file upload vulnerability in the resultimage.php script. The application fails to validate or sanitize user-supplied input before saving uploaded files to a publicly accessible directory. This flaw allows remote attackers to upload and execute arbitrary PHP code, resulting in full remote code execution under the web server context.
Exploits (3)
This Metasploit module exploits an arbitrary PHP file upload vulnerability in WebPageTest v2.6 or older. It uploads a malicious PHP file via the resultimage.php endpoint and executes it to achieve remote code execution.
This exploit demonstrates multiple vulnerabilities in WebPagetest <= 2.6, including local file disclosure (LFD) and arbitrary file upload (AFU) via directory traversal and insecure file handling. The PoC provides clear examples of how to exploit these flaws to read sensitive files or upload malicious files.
This Metasploit module exploits a file upload vulnerability in WebPageTest (CVE-2012-10049) by uploading a malicious PHP file to the server, leading to remote code execution. The exploit leverages the lack of file type verification in the resultimage.php endpoint.
References (6)
Scores
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N