Exploitation Summary
EIP tracks 3 public exploits for CVE-2013-10054.
PoCs published by Metasploit, CWH Underground, CWH, sinn3r, including Metasploit module exploits/unix/webapp/libretto_upload_exec.
AI-analyzed exploit summary This Metasploit module exploits an arbitrary file upload vulnerability in LibrettoCMS 1.1.7 by bypassing file extension checks to upload a malicious PHP file, enabling remote code execution.
Description
An unauthenticated arbitrary file upload vulnerability exists in LibrettoCMS version 1.1.7 (and possibly earlier) contains an unauthenticated arbitrary file upload vulnerability in its File Manager plugin. The upload handler located at adm/ui/js/ckeditor/plugins/pgrfilemanager/php/upload.php fails to properly validate file extensions, allowing attackers to upload files with misleading extensions and subsequently rename them to executable .php scripts. This enables remote code execution on the server without authentication.
Exploits (3)
This Metasploit module exploits an arbitrary file upload vulnerability in LibrettoCMS 1.1.7 by bypassing file extension checks to upload a malicious PHP file, enabling remote code execution.
This exploit leverages a file upload vulnerability in LibrettoCMS 2.2.2, allowing unauthenticated users to upload a malicious PHP file disguised as a .doc file and rename it to execute arbitrary PHP code on the server.
This Metasploit module exploits an arbitrary file upload vulnerability in LibrettoCMS 1.1.7 (and prior) by bypassing file extension checks to upload a malicious PHP file without authentication, leading to remote code execution.
References (5)
Scores
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N