CVE-2012-10044

MobileCartly version 1.0 contains an arbitrary file creation vulnerability in the savepage.php script. The application fails to perform authentication or authorization checks before invoking file_put_contents() on attacker-controlled input. An unauthenticated attacker can exploit this flaw by sending crafted HTTP GET requests to savepage.php, specifying both the filename and content. This allows arbitrary file creation within the pages/ directory or any writable path on the server, allowing remote code execution.

• CWE-434

• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/mobilecartly_upload_exec.rb
• https://web.archive.org/web/20120919081957/http://mobilecartly.com/
• https://www.exploit-db.com/exploits/20422
• https://www.exploit-db.com/exploits/21079
• https://www.vulncheck.com/advisories/mobilecartly-arbitrary-file-creation
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/mobilecartly_upload_exec.rb
• https://www.exploit-db.com/exploits/20422
• https://www.exploit-db.com/exploits/21079

Published

Aug 8, 2025

Last Modified

Jun 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-10039ZEN Load Balancer versions 2.0 and 3.0-rc1 contain a command…9.4
• CVE-2012-1004Multiple cross-site scripting (XSS) vulnerabilities in UI/Re…
• CVE-2012-10040Openfiler v2.x contains a command injection vulnerability in…9.4
• CVE-2012-10041WAN Emulator v2.3 contains two unauthenticated command execu…9.3
• CVE-2012-10042Sflog! CMS 1.0 contains an authenticated arbitrary file uplo…8.7
• CVE-2012-10043A stack-based buffer overflow vulnerability exists in ActFax…9.3
• CVE-2012-10045XODA version 0.4.5 contains an unauthenticated file upload v…9.3
• CVE-2012-10046The E-Mail Security Virtual Appliance (ESVA) (tested on vers…9.3
• CVE-2012-10047Cyclope Employee Surveillance Solution versions 6.x are vuln…10
• CVE-2012-10048Zenoss Core 3.x contains a command injection vulnerability i…8.7
• CVE-2012-10049WebPageTest version 2.6 and earlier contains an arbitrary fi…9.3
• CVE-2012-1005Multiple cross-site scripting (XSS) vulnerabilities in Sphin…