CriticalPublic exploit

Authenticated Arbitrary File Upload RCE in Glossword gw_admin.php

IdentifiersCVE-2013-10067CWE-434· Unrestricted Upload of File with…

CVE-2013-10067 affects Glossword versions 1.8.8 through 1.8.12. In standalone deployments, the administrative interface component gw_admin.php permits users with administrator privileges to upload files into the gw_temp/a/ directory. Because the upload handling does not sufficiently validate file type and path, an authenticated attacker can upload a PHP file or other server-executable payload and then invoke it via the web server. This results in arbitrary code execution on the hosting server.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an authenticated administrator-level attacker to achieve remote code execution in the context of the web application/server process. This can enable full compromise of the Glossword instance, modification or destruction of application data, deployment of persistent web shells or additional malware, access to sensitive files reachable by the web server account, and potential pivoting to other internal systems depending on host configuration and privileges.

Mitigation

If you can’t patch tonight, do this now.

Restrict access to the administrative interface to trusted administrators only and limit exposure via network ACLs, VPN, or IP allowlisting. Disable execution of PHP and other server-side scripts in the gw_temp/a/ upload directory at the web server level. Monitor the upload directory and web logs for unexpected file uploads or execution attempts. Apply least-privilege permissions to the web server account and use file integrity monitoring to detect web shells or malicious changes.

Remediation

Patch, then assume compromise.

Upgrade Glossword to a version newer than 1.8.12 if a fixed release is available. If upgrading is not immediately possible, modify the application to strictly validate uploaded files by enforcing an allowlist of safe extensions and MIME types, rejecting server-executable content, normalizing and validating paths, and storing uploads outside the web root or in a location where script execution is disabled. Review and remove any unauthorized files already present in gw_temp/a/ and rotate credentials if compromise is suspected.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.

VALID 1 / 1 TOTALView more in app

glossword_upload_exec.rbMaturityWeaponizedFrameworkmetasploitVerified exploit

This repository contains a single Metasploit module (glossword_upload_exec.rb) that exploits an authenticated arbitrary file upload vulnerability in Glossword versions 1.8.8 to 1.8.12. The exploit requires valid administrator credentials and targets the web application's file upload functionality, allowing the attacker to upload a malicious PHP payload to the 'gw_temp/a/' directory. The module then locates the uploaded file and triggers its execution, resulting in remote code execution on the server. The exploit is weaponized, supporting customizable payloads (such as Meterpreter shells) and is fully integrated into the Metasploit framework. The main endpoints targeted are '/gw_login.php' for authentication, '/gw_admin.php' for file upload and payload execution, and the 'gw_temp/a/' directory for storing the uploaded files. The code is written in Ruby and follows the standard Metasploit module structure.

Disclosed Feb 5, 2013rubynetwork

ACTIVITY FEED

Recent activity

3 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

3 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity3