{"vulnerability": "cve-2012-10054", "sightings": [{"uuid": "4d38ec5e-feaa-476b-ae54-71002a784e9a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2012-10054", "type": "seen", "source": "MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7", "content": "", "creation_timestamp": "2025-10-23T21:12:56.000000Z"}, {"uuid": "8d713840-a266-42e2-83e4-588c47fbd1f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2012-10054", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/umbraco_upload_aspx.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "f6c5eb16-1ff8-426f-8370-1eaac1bcb147", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2012-10054", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/umbraco_upload_aspx.rb", "content": "{\"aliases\": [], \"arch\": \"\", \"author\": [\"Toby Clarke\", \"juan vazquez \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"This module can be used to execute a payload on Umbraco CMS 4.7.0.378.\\n        The payload is uploaded as an ASPX script by sending a specially crafted\\n        SOAP request to codeEditorSave.asmx, which permits unauthorized file upload\\n        via the SaveDLRScript operation. SaveDLRScript is also subject to a path\\n        traversal vulnerability, allowing code to be placed into the web-accessible\\n        /umbraco/ directory.\\n\\n        The module writes, executes and then overwrites an ASPX script; note that\\n        though the script content is removed, the file remains on the target. Automatic\\n        cleanup of the file is intended if a meterpreter payload is used.\\n\\n        This module has been tested successfully on Umbraco CMS 4.7.0.378 on a Windows\\n        7 32-bit SP1. In this scenario, the \\\"IIS APPPOOL\\\\ASP.NET v4.0\\\" user must have\\n        write permissions on the Windows Temp folder.\", \"disclosure_date\": \"2012-06-28\", \"fullname\": \"exploit/windows/http/umbraco_upload_aspx\", \"is_install_path\": true, \"mod_time\": \"2026-06-17 11:11:50 +0000\", \"name\": \"Umbraco CMS Remote Command Execution\", \"needs_cleanup\": true, \"notes\": {}, \"path\": \"/modules/exploits/windows/http/umbraco_upload_aspx.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"windows/http/umbraco_upload_aspx\", \"references\": [\"CVE-2012-10054\", \"OSVDB-83765\", \"EDB-19671\", \"URL-http://blog.gdssecurity.com/labs/2012/7/3/find-bugs-faster-with-a-webmatrix-local-reference-instance.html\", \"URL-http://umbraco.codeplex.com/workitem/18192\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Umbraco CMS 4.7.0.378 / Microsoft Windows 7 Professional 32-bit SP1\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:52:01.686129Z"}]}