{"uuid": "f23c232d-646a-4fd6-8e50-01c356593f7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2012-10056", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/php_volunteer_upload_exec.rb", "content": "{\"aliases\": [], \"arch\": \"php\", \"author\": [\"Ashoo \", \"sinn3r \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits a vulnerability found in PHP Volunteer Management System,\\n          version v1.0.2 or prior.  This application has an upload feature that allows an\\n          authenticated user to upload anything to the 'uploads' directory, which is actually\\n          reachable by anyone without a credential.  An attacker can easily abuse this upload\\n          functionality first by logging in with the default credential (admin:volunteer),\\n          upload a malicious payload, and then execute it by sending another GET request.\", \"disclosure_date\": \"2012-05-28\", \"fullname\": \"exploit/multi/http/php_volunteer_upload_exec\", \"is_install_path\": true, \"mod_time\": \"2025-10-06 17:15:11 +0000\", \"name\": \"PHP Volunteer Management System v1.0.2 Arbitrary File Upload Vulnerability\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/multi/http/php_volunteer_upload_exec.rb\", \"platform\": \"PHP\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"multi/http/php_volunteer_upload_exec\", \"references\": [\"CVE-2012-10056\", \"OSVDB-82391\", \"EDB-18941\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"PHP Volunteer Management 1.0.2\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:07.958013Z"}