CVE-2012-10056 PHP Volunteer Management System 1.0.2 Arbitrary File Upload
Authenticated attackers can upload malicious PHP files to execute arbitrary code due to unrestricted file upload in the document module.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2012-10056?
CVE-2012-10056 is a high-severity vulnerability in PHP Volunteer Management, published on 13 Aug 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
PHP Volunteer Management System v1.0.2 contains an arbitrary file upload vulnerability in its document upload functionality. Authenticated users can upload files to the mods/documents/uploads/ directory without any restriction on file type or extension. Because this directory is publicly accessible and lacks execution controls, attackers can upload a malicious PHP payload and execute it remotely. The application ships with default credentials, making exploitation trivial. Once authenticated, the attacker can upload a PHP shell and trigger it via a direct GET request.
Weakness: CWE-434
Which versions are affected by CVE-2012-10056?
How do I fix CVE-2012-10056?
No fix has been published for CVE-2012-10056 yet. Limit exposure of the affected software until one is available.
Is CVE-2012-10056 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2012-10056 exists.
Public exploit code: 1 Metasploit module.
Sources
Also known as GHSA-m683-p5v4-h2p7.