CVE-2013-10054

An unauthenticated arbitrary file upload vulnerability exists in LibrettoCMS version 1.1.7 (and possibly earlier) contains an unauthenticated arbitrary file upload vulnerability in its File Manager plugin. The upload handler located at adm/ui/js/ckeditor/plugins/pgrfilemanager/php/upload.php fails to properly validate file extensions, allowing attackers to upload files with misleading extensions and subsequently rename them to executable .php scripts. This enables remote code execution on the server without authentication.

The following products are affected by CVE-2013-10054 vulnerability.

Here, you will find a curated list of external links that provide in-depth information to CVE-2013-10054.

URL	Resource
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/libretto_upload_exec.rb
https://sourceforge.net/projects/librettocms/
https://www.exploit-db.com/exploits/26213
https://www.exploit-db.com/exploits/26421
https://www.vulncheck.com/advisories/librettocms-file-manager-arbitrary-file-upload