{"uuid": "a430638c-4d9c-4e79-9864-e14831fbe889", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-1610", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/mediawiki_thumb.rb", "content": "{\"aliases\": [], \"arch\": \"php, cmd\", \"author\": [\"Netanel Rubin\", \"Brandon Perry\", \"Ben Harris\", \"Ben Campbell \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5 and 1.19.x before 1.19.11,\\n          when DjVu or PDF file upload support is enabled, allows remote unauthenticated\\n          users to execute arbitrary commands via shell metacharacters. If no target file\\n          is specified this module will attempt to log in with the provided credentials to\\n          upload a file (.DjVu) to use for exploitation.\", \"disclosure_date\": \"2014-01-28\", \"fullname\": \"exploit/multi/http/mediawiki_thumb\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:57:58 +0000\", \"name\": \"MediaWiki Thumb.php Remote Command Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/multi/http/mediawiki_thumb.rb\", \"platform\": \"PHP,Unix,Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/mediawiki_thumb\", \"references\": [\"CVE-2014-1610\", \"OSVDB-102630\", \"URL-http://www.checkpoint.com/threatcloud-central/articles/2014-01-28-tc-researchers-discover.html\", \"URL-https://bugzilla.wikimedia.org/show_bug.cgi?id=60339\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Automatic PHP-CLI\", \"Linux CMD\", \"Windows CMD\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:02.450836Z"}