CVE-2012-10033

published 2025-08-05

CVE-2012-10033: Narcissus is vulnerable to remote code execution via improper input handling in its image configuration workflow. Specifically, the backend.php script fails to…

Priority P2 67 critical 9.3 CVSS 4.0

AV N AC L AT N PR N UI N VC H VI H VA H SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

EXPLOIT

Narcissus is vulnerable to remote code execution via improper input handling in its image configuration workflow. Specifically, the backend.php script fails to sanitize the release parameter before passing it to the configure_image() function. This function invokes PHP’s passthru() with the unsanitized input, allowing attackers to inject arbitrary system commands. Exploitation occurs via a crafted POST request, resulting in command execution under the web server’s context.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
ngstr_m_distribution_project	narcissus	—	—

Detection & IOCs extracted from sources · hover to see the quote

path backend.php↗

other release (POST parameter)↗

• → Alert on web server processes spawning unexpected child shell processes, indicative of passthru() abuse in PHP ↗

• · Command execution occurs under the web server's privilege context, so impact is bounded by the web server user's OS permissions. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78