CVE-2012-10036: Project Pier <= 0.8.8 Arbitrary File Upload RCE
Project Pier 0.8.8 and earlier contains an unauthenticated arbitrary file upload vulnerability in tools/uploadfile.php. The upload handler fails to validate the file type or enforce authentication, allowing remote attackers to upload malicious PHP files directly into a web-accessible directory. The uploaded file is stored with a predictable suffix and can be executed by requesting its URL, resulting in remote code execution.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-10036?
CVE-2012-10036 has a high severity rating due to its potential for remote code execution through unauthenticated file uploads.
How do I fix CVE-2012-10036?
To fix CVE-2012-10036, update to Project Pier version 0.8.9 or later, which addresses the file upload vulnerability.
What are the risks associated with CVE-2012-10036?
The risks associated with CVE-2012-10036 include the potential for attackers to upload and execute arbitrary PHP files on the server.
Which versions of Project Pier are affected by CVE-2012-10036?
CVE-2012-10036 affects all versions of Project Pier up to and including version 0.8.8.
Is authentication required to exploit CVE-2012-10036?
No, CVE-2012-10036 allows attackers to exploit the vulnerability without any authentication.