CVE-2012-10042CWE-434

Sflog! CMS 1.0 Arbitrary File Upload RCE

High · published August 8, 2025

CVSS v4.0
8.7
EPSS
1%
Percentile
72.7
In the wild
Unconfirmed
What it is

Sflog! CMS 1.0 contains an authenticated arbitrary file upload vulnerability in the blog management interface. The application ships with default credentials (admin:secret) and allows authenticated users to upload files via manage.php. The upload mechanism fails to validate file types, enabling attackers to upload a PHP backdoor into a web-accessible directory (blogs/download/uploads/). Once uploaded, the file can be executed remotely, resulting in full remote code execution.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.01434 · 72.7th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2025-08-08T18:12Z
EPSS history
Timeline
  • 08 AUG 18:12Z
    Sflog! CMS 1.0 Arbitrary File Upload RCE
    cvelistv5