CVE-2013-10055

CVE-2013-10055 describes a critical unauthenticated arbitrary file upload vulnerability in Havalite CMS version 1.1.7 and potentially earlier, specifically within the upload.php script. This flaw allows remote attackers to upload malicious PHP files due to inadequate file extension validation and missing authentication checks. Successful exploitation leads to remote code execution by accessing the uploaded file directly. The vulnerability carries a CVSS 4.0 score of 9.3 (CRITICAL), indicating a severe risk with a network attack vector, low attack complexity, and no required privileges or user interaction. The potential impact includes high confidentiality, integrity, and availability compromise. While not listed on CISA's KEV catalog, a Metasploit module exists for this vulnerability, confirming readily available exploit code. Community discussion is notably high, with 18 mentions, suggesting significant awareness and potential interest among security researchers and threat actors.