CVE-2012-10056

published 2025-08-13

CVE-2012-10056: PHP Volunteer Management System v1.0.2 contains an arbitrary file upload vulnerability in its document upload functionality. Authenticated users can upload…

Priority P2 61 high 8.7 CVSS 4.0

AV N AC L AT N PR L UI N VC H VI H VA H SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

EXPLOIT

PHP Volunteer Management System v1.0.2 contains an arbitrary file upload vulnerability in its document upload functionality. Authenticated users can upload files to the mods/documents/uploads/ directory without any restriction on file type or extension. Because this directory is publicly accessible and lacks execution controls, attackers can upload a malicious PHP payload and execute it remotely. The application ships with default credentials, making exploitation trivial. Once authenticated, the attacker can upload a PHP shell and trigger it via a direct GET request.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
php_volunteer_management	php_volunteer_management	—	—

Detection & IOCs extracted from sources · hover to see the quote

path mods/documents/uploads/↗

other admin:volunteer↗

• → Monitor for unauthenticated GET requests to the uploads directory, which may indicate payload execution after a malicious file upload. ↗
• → Alert on file uploads containing PHP code (e.g., .php extensions or PHP magic bytes) to the mods/documents/uploads/ path by authenticated users. ↗
• → Detect use of default credentials (admin:volunteer) during authentication, which is a strong indicator of exploitation attempts against this application. ↗
• → A Metasploit module exists for this vulnerability; correlate exploit traffic patterns from the module php_volunteer_upload_exec.rb against web server logs. ↗

• · Exploitation requires authentication; however, the application ships with known default credentials (admin:volunteer), effectively making it unauthenticated in practice. ↗
• · The vulnerability affects PHP Volunteer Management System v1.0.2 and prior versions only. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434