CVE-2013-10032

CVE-2013-10032 is an authenticated remote code execution vulnerability affecting GetSimpleCMS version 3.2.1. It allows an authenticated attacker to upload arbitrary files, including PHP code disguised as a .pht file, due to insufficient MIME type and extension validation on the upload.php endpoint. This vulnerability carries a high CVSS score of 8.8, indicating a severe risk with network-based, low-privilege exploitation leading to full compromise of confidentiality, integrity, and availability. While not on the KEV catalog, a Metasploit module exists, and the vulnerability has significant community discussion, suggesting active awareness and potential for exploitation.