CVE-2013-10040

EUVD-2013-7258
ClipBucket version 2.6 and earlier contains a critical vulnerability in the ofc_upload_image.php script located at /admin_area/charts/ofc-library/. This endpoint allows unauthenticated users to upload arbitrary files, including executable PHP scripts. Once uploaded, the attacker can access the file via a predictable path and trigger remote code execution.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 98%
Affected Products (NVD)
VendorProductVersion
clip-bucketclipbucket
𝑥
≤ 2.6
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://clipbucket.com/
https://github.com/arslancb/clipbucket
https://packetstorm.news/files/id/123480
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/clipbucket_upload_exec.rb
https://www.vulncheck.com/advisories/clipbucket-arbitrary-file-upload-rce