PT-2025-32397 · Unknown · Mobilecartly

Published 2025-08-08 · Updated 2025-08-08 · CVE-2012-10044

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: MobileCartly version 1.0

Description: MobileCartly version 1.0 contains an arbitrary file creation vulnerability in the savepage.php script. The application does not perform authentication or authorization checks before using the file put contents() function with attacker-controlled input. An unauthenticated attacker can exploit this flaw by sending crafted HTTP GET requests to the /savepage.php endpoint, specifying both the filename and content. This allows arbitrary file creation within the pages/ directory or any writable path on the server, potentially leading to remote code execution.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2012-10044

Affected Products

Mobilecartly

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2012-10044 · Security Note
• https://t.me/CVEtracker/29535 · Telegram Post
• https://vulncheck.com/advisories/mobilecartly-arbitrary-file-creation · Note
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/mobilecartly_upload_exec.rb · Note
• https://exploit-db.com/exploits/20422 · Note
• https://web.archive.org/web/20120919081957/http://mobilecartly.com · Note
• https://exploit-db.com/exploits/21079 · Note