PT-2025-32403 · Cuteflow · Cuteflow

CVE-2012-10050 · Publicado 2025-08-08 · Atualizado 2025-08-08

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: CuteFlow versions 2.11.2 and earlier

Description: CuteFlow versions 2.11.2 and earlier contain an arbitrary file upload issue in the restart circulation values write.php script. The application does not validate or restrict uploaded file types, allowing unauthenticated attackers to upload arbitrary PHP files to the /upload/ 1/ directory. These files are then accessible via the web server, enabling remote code execution.

Recommendations: Update CuteFlow to a version later than 2.11.2.

Correção

RCE

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2012-10050

Produtos afetados

Cuteflow

Referências · 8

• http://web.archive.org/web/20210922054637/https://itsecuritysolutions.org/2012-07-01-CuteFlow-2.11.2-multiple-security-vulnerabilities · Nota
• https://vulncheck.com/advisories/cuteflow-arbitrary-file-upload-rce · Nota
• https://t.me/CVEtracker/29541 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2012-10050 · Nota de Segurança
• https://exploit-db.com/exploits/20111 · Nota
• https://web.archive.org/web/20120729071444/http://cuteflow.org · Nota
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/cuteflow_upload_exec.rb · Nota
• https://sourceforge.net/projects/cuteflow · Nota