### [CVE-2012-10050](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-10050)
![](https://img.shields.io/static/v1?label=Product&message=CuteFlow&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=*%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-434%20Unrestricted%20Upload%20of%20File%20with%20Dangerous%20Type&color=brightgreen)

### Description

CuteFlow version 2.11.2 and earlier contains an arbitrary file upload vulnerability in the restart_circulation_values_write.php script. The application fails to validate or restrict uploaded file types, allowing unauthenticated attackers to upload arbitrary PHP files to the upload/___1/ directory. These files are then accessible via the web server, enabling remote code execution.

### POC

#### Reference
- https://www.exploit-db.com/exploits/20111
- https://www.vulncheck.com/advisories/cuteflow-arbitrary-file-upload-rce

#### Github
- https://github.com/ARPSyndicate/cve-scores
- https://github.com/fkie-cad/nvd-json-data-feeds