CVE-2012-10042

Sflog! CMS 1.0 contains an authenticated arbitrary file upload vulnerability in the blog management interface. The application ships with default credentials (admin:secret) and allows authenticated users to upload files via manage.php. The upload mechanism fails to validate file types, enabling attackers to upload a PHP backdoor into a web-accessible directory (blogs/download/uploads/). Once uploaded, the file can be executed remotely, resulting in full remote code execution.

• CWE-434

• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/sflog_upload_exec.rb
• https://sourceforge.net/projects/sflog/
• https://www.exploit-db.com/exploits/19626
• https://www.vulncheck.com/advisories/sflog-cms-arbitrary-file-upload-rce
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/sflog_upload_exec.rb
• https://www.exploit-db.com/exploits/19626

Published

Aug 8, 2025

Last Modified

Jun 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-10037PhpTax version 0.8 contains a remote code execution vulnerab…9.3
• CVE-2012-10038Auxilium RateMyPet contains an unauthenticated arbitrary fil…9.3
• CVE-2012-10039ZEN Load Balancer versions 2.0 and 3.0-rc1 contain a command…9.4
• CVE-2012-1004Multiple cross-site scripting (XSS) vulnerabilities in UI/Re…
• CVE-2012-10040Openfiler v2.x contains a command injection vulnerability in…9.4
• CVE-2012-10041WAN Emulator v2.3 contains two unauthenticated command execu…9.3
• CVE-2012-10043A stack-based buffer overflow vulnerability exists in ActFax…9.3
• CVE-2012-10044MobileCartly version 1.0 contains an arbitrary file creation…10
• CVE-2012-10045XODA version 0.4.5 contains an unauthenticated file upload v…9.3
• CVE-2012-10046The E-Mail Security Virtual Appliance (ESVA) (tested on vers…9.3
• CVE-2012-10047Cyclope Employee Surveillance Solution versions 6.x are vuln…10
• CVE-2012-10048Zenoss Core 3.x contains a command injection vulnerability i…8.7