CVE-2013-10055: Havalite CMS Arbitary File Upload RCE
An unauthenticated arbitrary file upload vulnerability exists in Havalite CMS version 1.1.7 (and possibly earlier) in the upload.php script. The application fails to enforce proper file extension validation and authentication checks, allowing remote attackers to upload malicious PHP files via a crafted multipart/form-data POST request. Once uploaded, the attacker can access the file directly under havalite/tmp/files/, resulting in remote code execution.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-10055?
CVE-2013-10055 has a high severity rating due to the potential for unauthenticated remote file uploads.
How do I fix CVE-2013-10055?
To fix CVE-2013-10055, upgrade to a patched version of Havalite CMS that includes file upload validation enhancements.
What versions of Havalite CMS are affected by CVE-2013-10055?
CVE-2013-10055 affects Havalite CMS version 1.1.7 and possibly earlier versions.
What type of attacks can be conducted due to CVE-2013-10055?
CVE-2013-10055 allows remote attackers to upload malicious PHP files, potentially leading to remote code execution.
Is authentication required to exploit CVE-2013-10055?
No, CVE-2013-10055 can be exploited without authentication, making it particularly dangerous.