Arbitrary File Upload in PHP Volunteer Management System by PHP Volunteer

CVE-2012-10056

What is CVE-2012-10056?

The PHP Volunteer Management System v1.0.2 is susceptible to an arbitrary file upload vulnerability that allows authenticated users to upload files without any validation checks. This vulnerability stems from the unrestricted file upload functionality in the document upload section, where files can be placed directly into the publicly accessible mods/documents/uploads/ directory. As this directory lacks appropriate execution controls, it could be exploited by attackers to upload malicious files, such as PHP shells, enabling remote code execution. The presence of default credentials further simplifies the exploitation process, as attackers can gain access easily and execute harmful payloads via direct GET requests.

References