CVE-2013-10067

This Metasploit module exploits an arbitrary file upload vulnerability in Glossword versions 1.8.8 to 1.8.12, allowing authenticated administrators to upload and execute malicious PHP files.

This exploit demonstrates multiple vulnerabilities in Glossword 1.8.12, including XSS, database backup disclosure, and potential shell upload. It provides proof-of-concept examples for exploiting these vulnerabilities, such as a reflected XSS payload and a method to access sensitive database backups via HTTP.

This Metasploit module exploits an arbitrary file upload vulnerability in Glossword versions 1.8.8 to 1.8.12, allowing authenticated administrators to upload and execute PHP payloads.