CVE-2012-10056 (CNNVD-202508-1463)
中文标题:
Sourceforge PHP Volunteer Management 安全漏洞
英文标题:
PHP Volunteer Management System 1.0.2 Arbitrary File Upload
漏洞描述
中文描述:
Sourceforge PHP Volunteer Management是Sourceforge开源的一个基于PHP的志愿管理系统。 Sourceforge PHP Volunteer Management 1.0.2版本存在安全漏洞，该漏洞源于文档上传功能未限制文件类型，可能导致任意文件上传。
英文描述:
PHP Volunteer Management System v1.0.2 contains an arbitrary file upload vulnerability in its document upload functionality. Authenticated users can upload files to the mods/documents/uploads/ directory without any restriction on file type or extension. Because this directory is publicly accessible and lacks execution controls, attackers can upload a malicious PHP payload and execute it remotely. The application ships with default credentials, making exploitation trivial. Once authenticated, the attacker can upload a PHP shell and trigger it via a direct GET request.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| PHP Volunteer Management | PHP Volunteer Management | 1.0.2 | - | - |
cpe:2.3:a:php_volunteer_management:php_volunteer_management:1.0.2:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
4.0 (cna)
HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2012-10056 |
2025-11-11 15:18:27 | 2025-11-11 07:33:21 |
| NVD | nvd_CVE-2012-10056 |
2025-11-11 14:54:01 | 2025-11-11 07:42:11 |
| CNNVD | cnnvd_CNNVD-202508-1463 |
2025-11-11 15:12:53 | 2025-11-11 08:00:04 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 其他
- cnnvd_id: 未提取 -> CNNVD-202508-1463
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- data_sources: ['cve'] -> ['cve', 'nvd']