CVEvulnerability
CVE-2012-10052
9.3 CRITICAL
Official page ↗
- Status
- Deferred
- Published
- 2025-08-08
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 9.3 CRITICAL — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Weaknesses
- CWE-434
Description
EGallery version 1.2 contains an unauthenticated arbitrary file upload vulnerability in the uploadify.php script. The application fails to validate file types or enforce authentication, allowing remote attackers to upload malicious PHP files directly into the web-accessible egallery/ directory. This results in full remote code execution under the web server context.
Related
Weakness · CWE (1)
- CWE-434 Unrestricted Upload of File with Dangerous Type weakness
References
- http://web.archive.org/web/20170128123244/http://www.opensyscom.fr/Actualites/egallery-arbitrary-file-upload-vulnerability.html web.archive.org
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/egallery_upload_exec.rb raw.githubusercontent.com
- https://sourceforge.net/projects/e-gallery/ sourceforge.net
- https://www.exploit-db.com/exploits/20029 www.exploit-db.com
- https://www.vulncheck.com/advisories/egallery-arbitrary-php-file-upload www.vulncheck.com
- http://web.archive.org/web/20170128123244/http://www.opensyscom.fr/Actualites/egallery-arbitrary-file-upload-vulnerability.html web.archive.org
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/egallery_upload_exec.rb raw.githubusercontent.com
- https://www.exploit-db.com/exploits/20029 www.exploit-db.com