CVE-2012-10056 | BDVDB-2026-289449 Detail

Description#

PHP Volunteer Management System v1.0.2 contains an arbitrary file upload vulnerability in its document upload functionality. Authenticated users can upload files to the mods/documents/uploads/ directory without any restriction on file type or extension. Because this directory is publicly accessible and lacks execution controls, attackers can upload a malicious PHP payload and execute it remotely. The application ships with default credentials, making exploitation trivial. Once authenticated, the attacker can upload a PHP shell and trigger it via a direct GET request.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12025-08-13Record published in the CVE List.
2. Version 22026-07-15Most recent update recorded in the CVE List.