CVE-2012-10033

216.73.216.133

· Published 05/08/2025 20:15 · Modified 06/08/2025 16:15

Labels: CVE-2012-10033 2025-08-05 CVE-2012-10033 CWE-78 [email protected]

Essential information

Published: 05/08/2025 20:15
Modified: 06/08/2025 16:15
Author: —
Creator: —
CVSS: 9.3 CRITICAL (v3) 9.3 CRITICAL (v4.0)
CISA KEV: No
CWE: —
CVSS vector: —

CVSS metrics

Description

Narcissus is vulnerable to remote code execution via improper input handling in its image configuration workflow. Specifically, the backend.php script fails to sanitize the release parameter before passing it to the configure_image() function. This function invokes PHP’s passthru() with the unsanitized input, allowing attackers to inject arbitrary system commands. Exploitation occurs via a crafted POST request, resulting in command execution under the web server’s context.

NVD status

Status: Awaiting Analysis — CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.
Source: [email protected]
NVD: View on NVD

Affected products (CPE)

Product	CPE
* / narcissus	`cpe:2.3:a::narcissus::::::::*`