CVE-2012-10045 XODA 0.4.5 Arbitrary PHP File Upload
Unauthenticated attackers can upload arbitrary PHP files to execute code on the server via the vulnerable upload functionality.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2012-10045?
CVE-2012-10045 is a critical vulnerability in XODA, published on 8 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
XODA version 0.4.5 contains an unauthenticated file upload vulnerability that allows remote attackers to execute arbitrary PHP code on the server. The flaw resides in the upload functionality, which fails to properly validate or restrict uploaded file types. By crafting a multipart/form-data POST request, an attacker can upload a .php file directly into the web-accessible files/ directory and trigger its execution via a subsequent GET request.
Weakness: CWE-434
Which versions are affected by CVE-2012-10045?
How do I fix CVE-2012-10045?
No fix has been published for CVE-2012-10045 yet. Limit exposure of the affected software until one is available.
Is CVE-2012-10045 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2012-10045 exists.
Public exploit code: 1 Metasploit module.
Sources
Also known as GHSA-xqrc-jpv5-hccp.