CVE-2012-10045

XODA version 0.4.5 contains an unauthenticated file upload vulnerability that allows remote attackers to execute arbitrary PHP code on the server. The flaw resides in the upload functionality, which fails to properly validate or restrict uploaded file types. By crafting a multipart/form-data POST request, an attacker can upload a .php file directly into the web-accessible files/ directory and trigger its execution via a subsequent GET request.

• CWE-434

• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/xoda_file_upload.rb
• https://sourceforge.net/projects/xoda/
• https://www.exploit-db.com/exploits/20703
• https://www.exploit-db.com/exploits/20713
• https://www.vulncheck.com/advisories/xoda-arbitrary-php-file-upload
• https://xoda.org/
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/xoda_file_upload.rb
• https://www.exploit-db.com/exploits/20703
• https://www.exploit-db.com/exploits/20713

Published

Aug 8, 2025

Last Modified

Jun 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-1004Multiple cross-site scripting (XSS) vulnerabilities in UI/Re…
• CVE-2012-10040Openfiler v2.x contains a command injection vulnerability in…9.4
• CVE-2012-10041WAN Emulator v2.3 contains two unauthenticated command execu…9.3
• CVE-2012-10042Sflog! CMS 1.0 contains an authenticated arbitrary file uplo…8.7
• CVE-2012-10043A stack-based buffer overflow vulnerability exists in ActFax…9.3
• CVE-2012-10044MobileCartly version 1.0 contains an arbitrary file creation…10
• CVE-2012-10046The E-Mail Security Virtual Appliance (ESVA) (tested on vers…9.3
• CVE-2012-10047Cyclope Employee Surveillance Solution versions 6.x are vuln…10
• CVE-2012-10048Zenoss Core 3.x contains a command injection vulnerability i…8.7
• CVE-2012-10049WebPageTest version 2.6 and earlier contains an arbitrary fi…9.3
• CVE-2012-1005Multiple cross-site scripting (XSS) vulnerabilities in Sphin…
• CVE-2012-10050CuteFlow version 2.11.2 and earlier contains an arbitrary fi…9.3