CVE-2013-10040

CriticalPublic PoC

Published: 31 July 2025

Published

31 July 2025

Modified

23 September 2025

KEV Added

—

Patch

—

CVSS Score v4 10.0 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.7717 99.0th percentile

Risk Priority 66 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2013-10040 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Clip-Bucket Clipbucket. Its CVSS base score is 10.0 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 1.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2013-10040 is a critical vulnerability, scored at 9.8 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and associated with CWE-434 (Unrestricted Upload of File with Dangerous Type), affecting ClipBucket version 2.6 and earlier. The flaw resides in the ofc_upload_image.php script located at /admin_area/charts/ofc-library/, which permits unauthenticated users to upload arbitrary files, including executable PHP scripts.

Unauthenticated attackers can exploit this vulnerability remotely with low complexity by sending a malicious file to the affected endpoint. Once uploaded, the attacker accesses the file via a predictable path, triggering remote code execution on the server and potentially gaining full control over the application and underlying system.

Advisories, including one from VulnCheck, document the arbitrary file upload leading to RCE, while a Metasploit Framework module (unix/webapp/clipbucket_upload_exec.rb) demonstrates automated exploitation. Additional references point to the official ClipBucket website, its GitHub repository, and Packet Storm for further details on the issue.

A public Metasploit exploit module highlights the vulnerability's exploitability in real-world scenarios, underscoring the need for immediate upgrades or removal of unpatched ClipBucket installations.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2013-7258

Vulnerability details

ClipBucket version 2.6 and earlier contains a critical vulnerability in the ofc_upload_image.php script located at /admin_area/charts/ofc-library/. This endpoint allows unauthenticated users to upload arbitrary files, including executable PHP scripts. Once uploaded, the attacker can access the file via a predictable…

path and trigger remote code execution.

CWE(s): CWE-434

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1105 Ingress Tool Transfer Command And Control

Adversaries may transfer tools or other files from an external system into a compromised environment.

attack.mitre.org →

T1505.003 Web Shell Persistence

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

attack.mitre.org →

Why these techniques?

Direct arbitrary file upload to public web app enables remote exploitation (T1190), malicious file ingress (T1105), and web shell deployment for RCE (T1505.003).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1