VulnSocial

CVE-2012-10044Disclosure

LOWCVSS 10.0 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Prioritize remediation for affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

MobileCartly version 1.0 contains an arbitrary file creation vulnerability in the savepage.php script. The application fails to perform authentication or authorization checks before invoking file_put_contents() on attacker-controlled input. An unauthenticated attacker can exploit this flaw by sending crafted HTTP GET requests to savepage.php, specifying both the filename and content. This allows arbitrary file creation within the pages/ directory or any writable path on the server, allowing remote code execution.

Back to dashboard
2.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-434

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • Exploit tooling references are present in monitored signal
  • 1 mentions across 1 observed day

What's happening

  • Exploit tool or code specified in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-04-07: 1Exploit Tool / Code · 2026-04-07: 1Technical Details · 2026-04-07: 104-07
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • 0day Signal@0dayPublishing
    Disclosure

    🚨 CVE-2012-10044: MobileCartly 1.0 savepage.php Ar... Unauthenticated file_put_contents() with user-controlled filename and content = instant RCE via GET request - Metasploi... https://zerodaysignal.com/vulnerability/CVE-2012-10044 #netsec #vulnerability #CVE #sysadmin #zeroday

    Post summary

    The tweet announces CVE-2012-10044 in MobileCartly 1.0, outlining an unauthenticated RCE via file_put_contents and pointing to a potential Metasploit-based exploit, but offers no patch or evidence of active exploitation.

    0000025
    204 followersView on X

Explore more

Back to dashboard