CVE-2013-10034

CVE-2013-10034 describes an unrestricted file upload vulnerability in Kaseya KServer versions prior to 6.3.0.2, allowing unauthenticated attackers to upload arbitrary files, including executable ASP files, to web-accessible directories. This critical vulnerability (CVSS 9.3) enables remote code execution with IUSR account privileges due to a lack of authentication and input sanitation on the uploadImage.asp endpoint. Exploit code is publicly available via a Metasploit module, and while it is not on the KEV catalog, its high EPSS and FAUCET Risk Score, coupled with significant community discussion, indicate a high likelihood of exploitation. The vulnerability was resolved by removing the vulnerable endpoint in version 6.3.0.2.