CVE-2012-10022

Kloxo versions 6.1.12 and earlier contain two setuid root binaries—lxsuexec and lxrestart—that allow local privilege escalation from uid 48. The lxsuexec binary performs a uid check and permits execution of arbitrary commands as root if the invoking user matches uid 48. This flaw enables attackers with Apache-level access to escalate privileges to root without authentication.

• CWE-269

• https://github.com/KloxoNGCommunity/kloxo
• https://kloxo.org/
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/local/kloxo_lxsuexec.rb
• https://web.archive.org/web/20121122063935/http://roothackers.net/showthread.php?tid=92
• https://www.exploit-db.com/exploits/25406
• https://www.vulncheck.com/advisories/kloxo-local-priv-esc
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/local/kloxo_lxsuexec.rb
• https://web.archive.org/web/20121122063935/http://roothackers.net/showthread.php?tid=92
• https://www.exploit-db.com/exploits/25406

Published

Aug 1, 2025

Last Modified

Jun 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-10017A vulnerability was found in BestWebSoft Portfolio Plugin up…8.8
• CVE-2012-10018The Mapplic and Mapplic Lite plugins for WordPress are vulne…8.3
• CVE-2012-10019The Front End Editor plugin for WordPress is vulnerable to a…9.8
• CVE-2012-1002SQL injection vulnerability in author/edit.php in OpenConf 4…
• CVE-2012-10020The FoxyPress plugin for WordPress is vulnerable to arbitrar…9.8
• CVE-2012-10021A stack-based buffer overflow vulnerability exists in D-Link…9.8
• CVE-2012-10023A stack-based buffer overflow vulnerability exists in FreeFl…9.8
• CVE-2012-10024XBMC version 11.0 contains a path traversal vulnerability in…7.1
• CVE-2012-10025The WordPress plugin Advanced Custom Fields (ACF) version 3.…10
• CVE-2012-10026The WordPress plugin Asset-Manager version 2.0 and below con…10
• CVE-2012-10027WP-Property plugin for WordPress up to and including version…9.3
• CVE-2012-10028Netwin SurgeFTP version 23c8 and prior contains a vulnerabil…8.6