CVE-2012-10037CWE-78
PhpTax pfilez Parameter Exec Remote Code Injection
Critical · published August 11, 2025
What it is
PhpTax version 0.8 contains a remote code execution vulnerability in drawimage.php. The pfilez GET parameter is unsafely passed to the exec() function without sanitization. A remote attacker can inject arbitrary shell commands, leading to code execution under the web server's context. No authentication is required.
The record
Technical detail
- CVSS v4.0
- 9.3 · CRITICAL
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS
- 0.01715 · 77.1th percentile
- Weakness
- CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- Published
- 2025-08-11T14:54Z
EPSS history
Timeline