CriticalPublic exploit

Unauthenticated Arbitrary File Upload RCE in XODA 0.4.5

IdentifiersCVE-2012-10045CWE-434· Unrestricted Upload of File with…

XODA version 0.4.5 contains an unauthenticated arbitrary file upload vulnerability in its upload functionality. The application does not properly validate or restrict uploaded file types, allowing a remote attacker to submit a crafted multipart/form-data POST request containing a PHP file. Because the uploaded file is placed in the web-accessible files/ directory, the attacker can then issue a subsequent HTTP GET request to the uploaded script and cause the server to execute arbitrary PHP code. The issue is therefore an unrestricted file upload that directly leads to remote code execution.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary PHP code in the context of the web server process. This can result in full compromise of the affected application, unauthorized access to or modification of application data, deployment of web shells or other malware, persistence on the host, and potential pivoting to other internal systems depending on the server's privileges and network reachability.

Mitigation

If you can’t patch tonight, do this now.

As an immediate mitigation, disable the vulnerable upload feature if it is not required. Block uploads of executable script types at the application and web server layers, and prevent script execution in the upload directory through server configuration. Restrict access to the upload endpoint with authentication or network controls where possible, deploy WAF rules to detect suspicious multipart/form-data uploads containing PHP payloads, and continuously monitor the upload directory for newly created executable files.

Remediation

Patch, then assume compromise.

Upgrade to a fixed version of XODA if one is available from the vendor. If source modification is required, harden the upload functionality to strictly enforce an allowlist of permitted file types, validate file content rather than relying only on extensions or MIME types, reject executable server-side script formats such as .php, and store uploaded files outside the web root. Configure the web server so uploaded content cannot be executed as code. Review the files/ directory and server logs for evidence of malicious uploads and remove any unauthorized files.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.

VALID 1 / 1 TOTALView more in app

xoda_file_upload.rbMaturityWeaponizedFrameworkmetasploitVerified exploit

This repository contains a single Metasploit module (modules/exploits/unix/webapp/xoda_file_upload.rb) targeting a file upload vulnerability in XODA 0.4.5 (CVE-2012-10045). The exploit abuses the unauthenticated 'upload' functionality to upload a malicious PHP file, which is then executed to achieve arbitrary code execution on the target server. The module is written in Ruby and leverages Metasploit's HttpClient mixin to interact with the vulnerable web application. The main attack vector is network-based, targeting the web application's file upload endpoint. The module provides operational exploit capability, allowing the attacker to execute arbitrary PHP code (Metasploit payloads) on the target. The endpoints involved are customizable via the TARGETURI option, with default paths under /xoda/. The exploit is not a detection script or a fake; it is a fully functional exploit module for Metasploit.

Disclosed Aug 21, 2012rubynetwork

ACTIVITY FEED

Recent activity

3 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

3 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity3