CVE-2013-10038

critical · 9.3

An unauthenticated arbitrary file upload vulnerability exists in FlashChat versions 6.0.2 and 6.0.4 through 6.0.8. The upload.php endpoint fails to properly validate file types and authentication, allowing attackers to upload malicious PHP scripts. Once uploaded, these scripts can be executed remotely, resulting in arbitrary code execution as the web server user.

9.3

CVSS

1.3%

EPSS (exploit prob.)

69th

EPSS percentile

2025-07-31

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-434

References

https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/flashchat_upload_exec.rb
https://www.exploit-db.com/exploits/28709
https://www.fortiguard.com/encyclopedia/ips/37342/flashchat-arbitrary-file-upload
https://www.phpbb.com/community/viewtopic.php?t=2627786
https://www.vulncheck.com/advisories/flashchat-arbitrary-file-upload-rce

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2013-10038