CVE-2012-10054
CRITICALUmbraco CMS < 4.7.1 - Unauthenticated Remote Code Execution via codeEditorSave.asmx SaveDLRScript Path Traversal
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2012-10054.
PoCs published by Metasploit, Toby Clarke, juan vazquez, including Metasploit module exploits/windows/http/umbraco_upload_aspx.
AI-analyzed exploit summary This Metasploit module exploits an unauthenticated file upload vulnerability in Umbraco CMS 4.7.0.378 via a SOAP request to codeEditorSave.asmx, allowing arbitrary ASPX file upload and remote code execution. The exploit leverages path traversal to place the payload in a web-accessible directory.
Description
Umbraco CMS versions prior to 4.7.1 are vulnerable to unauthenticated remote code execution via the codeEditorSave.asmx SOAP endpoint, which exposes a SaveDLRScript operation that permits arbitrary file uploads without authentication. By exploiting a path traversal flaw in the fileName parameter, attackers can write malicious ASPX scripts directly into the web-accessible /umbraco/ directory and execute them remotely.
Exploits (2)
This Metasploit module exploits an unauthenticated file upload vulnerability in Umbraco CMS 4.7.0.378 via a SOAP request to codeEditorSave.asmx, allowing arbitrary ASPX file upload and remote code execution. The exploit leverages path traversal to place the payload in a web-accessible directory.
This Metasploit module exploits a path traversal and unauthorized file upload vulnerability in Umbraco CMS 4.7.0.378 to achieve remote command execution. It uploads an ASPX payload via a crafted SOAP request, executes it, and attempts cleanup if a Meterpreter session is established.
References (6)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H