CVE-2012-6081
EXPLOITED IN THE WILDMoinMoin < 1.9.6 - Authenticated Remote Code Execution via File Upload
Title source: llmExploitation Summary
CVE-2012-6081 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io).
EIP tracks 3 public exploits from researchers including HTP, Unknown, HTP, juan vazquez, including a Metasploit module exploits/unix/webapp/moinmoin_twikidraw.
AI-analyzed exploit summary This Python script exploits CVE-2012-6081, a remote code execution vulnerability in MoinMoin wiki software. It allows an attacker to upload a malicious file to the WikiSandBox page, enabling either a stealth webshell or a backconnect shell depending on the chosen method.
Description
Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory, as exploited in the wild in July 2012.
Exploits (3)
This Python script exploits CVE-2012-6081, a remote code execution vulnerability in MoinMoin wiki software. It allows an attacker to upload a malicious file to the WikiSandBox page, enabling either a stealth webshell or a backconnect shell depending on the chosen method.
This Metasploit module exploits a directory traversal vulnerability in MoinMoin 1.9.5's twikidraw action to upload arbitrary files, specifically targeting the moin.wsgi file to achieve remote code execution. It includes authentication handling, payload delivery, and a post-exploitation restoration attempt.
This Metasploit module exploits a directory traversal vulnerability in MoinMoin 1.9.5 to upload arbitrary files, specifically targeting the moin.wsgi file to achieve remote code execution. It includes functionality to restore the original file post-exploitation.