{"uuid": "b416052b-f340-44ca-9b1b-adb18ea18016", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2012-10037", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/phptax_exec.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Jean Pascal Pereira \", \"sinn3r \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a vulnerability found in PhpTax, an income tax report\\n          generator.  When generating a PDF, the icondrawpng() function in drawimage.php\\n          does not properly handle the pfilez parameter, which will be used in an exec()\\n          statement, and then results in arbitrary remote code execution under the context\\n          of the web server.  Please note: authentication is not required to exploit this\\n          vulnerability.\", \"disclosure_date\": \"2012-10-08\", \"fullname\": \"exploit/multi/http/phptax_exec\", \"is_install_path\": true, \"mod_time\": \"2026-04-16 16:27:36 +0000\", \"name\": \"PhpTax pfilez Parameter Exec Remote Code Injection\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/multi/http/phptax_exec.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/phptax_exec\", \"references\": [\"CVE-2012-10037\", \"OSVDB-86992\", \"EDB-21665\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"PhpTax 0.8\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:09.038592Z"}