CVE-2012-10045

CVE-2012-10045 describes an unauthenticated file upload vulnerability in XODA version 0.4.5, allowing remote attackers to execute arbitrary PHP code. The flaw stems from insufficient validation of uploaded file types, enabling attackers to upload malicious PHP files directly into a web-accessible directory. This critical vulnerability (CVSS 9.3) has a low attack complexity and requires no authentication, leading to high impacts on confidentiality, integrity, and availability. While not listed on CISA's KEV, a Metasploit module exists, and the vulnerability has garnered significant community discussion, indicating potential for exploitation.