CriticalPublic exploit

Unauthenticated Arbitrary File Upload RCE in CuteFlow restart_circulation_values_write.php

IdentifiersCVE-2012-10050CWE-434· Unrestricted Upload of File with…

CVE-2012-10050 is an arbitrary file upload vulnerability affecting CuteFlow 2.11.2 and earlier. The flaw is present in the restart_circulation_values_write.php script, which does not properly validate or restrict uploaded file types. As a result, an unauthenticated attacker can upload an arbitrary PHP file into the upload/___1/ directory. Because the uploaded file is subsequently accessible through the web server, the attacker can invoke the uploaded PHP script directly, resulting in remote code execution on the target server.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an unauthenticated remote attacker to place attacker-controlled PHP code on the server and execute it via HTTP. This can lead to full compromise of the web application context, including arbitrary command execution with the privileges of the web server process, deployment of webshells, data theft or modification, and potential follow-on compromise of the underlying host or connected systems depending on server configuration and privilege boundaries.

Mitigation

If you can’t patch tonight, do this now.

As an immediate mitigation, block unauthenticated access to the vulnerable upload endpoint, or restrict access to trusted users and networks only. Configure the web server so that PHP and other executable content cannot be executed from upload directories such as upload/___1/. Apply file upload filtering with extension and MIME/content validation, use randomized non-web-accessible storage locations for uploads, and deploy WAF rules to detect or block suspicious multipart upload requests targeting restart_circulation_values_write.php. Continuous monitoring of upload paths for newly created executable files is also advisable.

Remediation

Patch, then assume compromise.

Upgrade CuteFlow to a fixed version if one is available from the vendor. If no patched release is available, modify or disable the vulnerable restart_circulation_values_write.php upload functionality until proper server-side validation is implemented. Enforce strict allowlisting of permitted file types, verify content rather than relying only on file extensions, store uploads outside the web root, and prevent execution of uploaded content in upload directories. Review the upload/___1/ directory and server logs for unauthorized uploaded PHP files or webshell activity, and remove any malicious files discovered.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.

VALID 1 / 1 TOTALView more in app

cuteflow_upload_exec.rbMaturityWeaponizedFrameworkmetasploitVerified exploit

This repository contains a single Metasploit module (modules/exploits/multi/http/cuteflow_upload_exec.rb) that exploits an arbitrary file upload vulnerability in CuteFlow version 2.11.2 and prior (CVE-2012-10050). The exploit works by uploading a PHP payload to the 'upload/___1/' directory via the vulnerable 'pages/restart_circulation_values_write.php' endpoint, then triggering execution by sending a GET request to the uploaded file. The module is fully integrated with Metasploit, allowing the use of customizable payloads (such as reverse shells or Meterpreter sessions). No authentication is required for exploitation. The code is written in Ruby and leverages the Metasploit framework's HTTP client utilities. The repository is highly focused, containing only the exploit module file.

Disclosed Jul 27, 2012rubynetwork

ACTIVITY FEED

Recent activity

4 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

4 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity4