CVE-2012-6710: ext_find_user in eXtplorer through 2.1.2 allows remote attackers to bypass authentication via a password[]= (aka an empty array) in an action=login request to…

PriorityP273critical9.8CVSS 3.0

AVNACLPRNUINSUCHIHAH

EXPLOIT

EPSS

24.97%

97.6th percentile

ext_find_user in eXtplorer through 2.1.2 allows remote attackers to bypass authentication via a password[]= (aka an empty array) in an action=login request to index.php.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
extplorer	extplorer	<= 2.1.2	—

Detection & IOCsextracted from sources · hover to see the quote

urlindex.php?action=login↗

commandpassword[]=↗

→Monitor POST requests to index.php with action=login containing a password parameter submitted as an empty array (password[]=) rather than a string value — this is the authentication bypass trigger for eXtplorer <= 2.1.2. ↗
→After a successful authentication bypass, watch for subsequent file upload requests to writable directories under the web root from the same session — the exploit chain uploads and executes an arbitrary file. ↗
→Flag any file upload activity performed by a session that authenticated via the empty-array password bypass, particularly targeting writable directories in the web root. ↗

·The authentication bypass only affects eXtplorer when run as a standalone application; deployments integrated into other frameworks may have different attack surfaces. ↗
·The vulnerable versions are eXtplorer 2.1.0 through 2.1.2 (inclusive) and 2.1.0RC5; versions outside this range are not confirmed affected by this specific bypass. ↗

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

osv9.8CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.