CriticalPublic exploit

Unauthenticated Arbitrary File Upload in LibrettoCMS 1.1.7 File Manager

IdentifiersCVE-2013-10054CWE-434· Unrestricted Upload of File with…

CVE-2013-10054 is an unauthenticated arbitrary file upload vulnerability in LibrettoCMS version 1.1.7, and possibly earlier versions, affecting the File Manager plugin. The vulnerable upload handler is located at adm/ui/js/ckeditor/plugins/pgrfilemanager/php/upload.php. The handler does not properly validate uploaded file extensions, which allows an attacker to upload a file using a misleading or non-executable extension and then rename it to a .php script. Because the uploaded PHP file can then be executed by the web server, the issue results in unauthenticated remote code execution on the target server.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows a remote, unauthenticated attacker to place attacker-controlled files on the server and convert them into executable PHP scripts. This can lead to full remote code execution in the context of the web server process, enabling compromise of the application, theft or modification of data, deployment of web shells or additional malware, and potential further lateral movement depending on the server's privileges and environment.

Mitigation

If you can’t patch tonight, do this now.

Restrict or disable access to the vulnerable File Manager upload functionality, especially for unauthenticated users. Block direct access to adm/ui/js/ckeditor/plugins/pgrfilemanager/php/upload.php at the web server or WAF layer. Configure the web server so upload directories do not execute PHP or other server-side scripts. Monitor for unexpected file uploads, renamed files, and web-shell-like artifacts in CMS-managed directories. Apply least-privilege permissions to the web server account to limit post-exploitation impact.

Remediation

Patch, then assume compromise.

Upgrade LibrettoCMS and the affected File Manager component to a version in which upload handling enforces strict server-side validation of allowed file types and prevents uploaded files from being renamed into executable server-side script extensions. If no vendor patch is available, modify or remove the vulnerable upload.php handler, implement a strict allowlist of permitted extensions and MIME types, store uploads outside the web root, and ensure uploaded content cannot be executed as PHP.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.

VALID 1 / 1 TOTALView more in app

libretto_upload_exec.rbMaturityWeaponizedFrameworkmetasploitVerified exploit

This repository contains a single Metasploit module (libretto_upload_exec.rb) that exploits an arbitrary file upload vulnerability in LibrettoCMS 1.1.7 and possibly earlier versions. The exploit works by uploading a malicious PHP payload disguised as a .pdf file to the vulnerable file manager component, then renaming it to a .php extension, and finally executing it to achieve remote code execution. The module is fully integrated with Metasploit, allowing for customizable payloads and automated exploitation. The main endpoints targeted are the file upload and file rename scripts within the LibrettoCMS installation. The exploit is weaponized, as it is part of the Metasploit framework and supports a variety of payloads. The code is written in Ruby and leverages Metasploit's HTTP client and PHP payload generation capabilities.

Disclosed Jun 14, 2013rubynetwork

ACTIVITY FEED

Recent activity

4 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

4 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity4