Glossword 1.8.8-1.8.12 - Authenticated Arbitrary File Upload and Remote Code Execution via Administrative Interface
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2013-10067.
PoCs published by Metasploit, AkaStep, AkaStep, bcoles, including Metasploit module exploits/multi/http/glossword_upload_exec.
AI-analyzed exploit summary This Metasploit module exploits an arbitrary file upload vulnerability in Glossword versions 1.8.8 to 1.8.12, allowing authenticated administrators to upload and execute malicious PHP files.
Description
Glossword versions 1.8.8 through 1.8.12 contain an authenticated arbitrary file upload vulnerability. When deployed as a standalone application, the administrative interface (gw_admin.php) allows users with administrator privileges to upload files to the gw_temp/a/ directory. Due to insufficient validation of file type and path, attackers can upload and execute PHP payloads, resulting in remote code execution.
Exploits (3)
This Metasploit module exploits an arbitrary file upload vulnerability in Glossword versions 1.8.8 to 1.8.12, allowing authenticated administrators to upload and execute malicious PHP files.
This exploit demonstrates multiple vulnerabilities in Glossword 1.8.12, including XSS, database backup disclosure, and potential shell upload. It provides proof-of-concept examples for exploiting these vulnerabilities, such as a reflected XSS payload and a method to access sensitive database backups via HTTP.
This Metasploit module exploits an arbitrary file upload vulnerability in Glossword versions 1.8.8 to 1.8.12, allowing authenticated administrators to upload and execute PHP payloads.
References (6)
Scores
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H