MiniWeb HTTP Server up to Build 300 Management Instrumentation Service unrestricted upload

Summaryinfo

A vulnerability described as critical has been identified in MiniWeb HTTP Server up to Build 300. This affects an unknown function of the component Management Instrumentation Service. Executing a manipulation can lead to unrestricted upload. This vulnerability appears as CVE-2013-10047. The attack may be performed from remote. In addition, an exploit is available.

Detailsinfo

A vulnerability has been found in MiniWeb HTTP Server up to Build 300 and classified as critical. This vulnerability affects an unknown code block of the component Management Instrumentation Service. The manipulation with an unknown input leads to a unrestricted upload vulnerability. The CWE definition for the vulnerability is CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote attackers to upload arbitrary files to the server’s filesystem. By abusing the upload handler and crafting a traversal path, an attacker can place a malicious .exe in system32, followed by a .mof file in the WMI directory. This triggers execution of the payload with SYSTEM privileges via the Windows Management Instrumentation service. The exploit is only viable on Windows versions prior to Vista.

The weakness was presented by AkaStep. The advisory is shared for download at raw.githubusercontent.com. This vulnerability was named CVE-2013-10047 since 08/01/2025. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are unknown but a public exploit is available. The MITRE ATT&CK project declares the attack technique as T1608.002.

It is possible to download the exploit at exploit-db.com. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Exploit-DB (27607) and EUVD (EUVD-2013-7267). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Web Server

Vendor

• MiniWeb

Name

• HTTP Server

Version

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion