CVE-2012-1153
appRain CMF <= 0.1.5 - Unauthenticated Arbitrary File Upload and Remote Code Execution
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2012-1153.
PoCs published by Metasploit, EgiX, EgiX, sinn3r, including Metasploit module exploits/multi/http/apprain_upload_exec.
AI-analyzed exploit summary This Metasploit module exploits an unauthenticated arbitrary file upload vulnerability in appRain CMF 0.1.5 or earlier via the uploadify.php endpoint, allowing remote code execution by uploading a malicious PHP file.
Description
Unrestricted file upload vulnerability in addons/uploadify/uploadify.php in appRain CMF 0.1.5 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the uploads directory.
Exploits (3)
This Metasploit module exploits an unauthenticated arbitrary file upload vulnerability in appRain CMF 0.1.5 or earlier via the uploadify.php endpoint, allowing remote code execution by uploading a malicious PHP file.
This exploit demonstrates an unrestricted file upload vulnerability in appRain CMF <= 0.1.5, allowing an attacker to upload a malicious PHP file and execute arbitrary commands via a reverse shell. The vulnerability arises due to lack of file extension validation and authentication checks in the uploadify.php script.
This Metasploit module exploits an unauthenticated arbitrary PHP file upload vulnerability in appRain CMF 0.1.5 or less via the uploadify.php endpoint, leading to remote code execution.