Exploitation Summary
EIP tracks 2 public exploits for CVE-2013-10055.
PoCs published by CWH Underground, CWH, sinn3r, including Metasploit module exploits/unix/webapp/havalite_upload_exec.
AI-analyzed exploit summary This exploit targets an unrestricted file upload vulnerability in Havalite CMS 1.1.7, allowing an attacker to upload a malicious PHP file and execute arbitrary commands via a reverse shell. The PoC demonstrates the vulnerability by uploading a shell and interacting with it.
Description
An unauthenticated arbitrary file upload vulnerability exists in Havalite CMS version 1.1.7 (and possibly earlier) in the upload.php script. The application fails to enforce proper file extension validation and authentication checks, allowing remote attackers to upload malicious PHP files via a crafted multipart/form-data POST request. Once uploaded, the attacker can access the file directly under havalite/tmp/files/, resulting in remote code execution.
Exploits (2)
This exploit targets an unrestricted file upload vulnerability in Havalite CMS 1.1.7, allowing an attacker to upload a malicious PHP file and execute arbitrary commands via a reverse shell. The PoC demonstrates the vulnerability by uploading a shell and interacting with it.
This Metasploit module exploits an unauthenticated arbitrary file upload vulnerability in Havalite CMS 1.1.7, allowing remote code execution by uploading a malicious PHP file. The exploit leverages the upload feature to bypass restrictions and execute payloads.
References (4)
Scores
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N