Skip to content
Fencer Intel
critical 9.3

CVE-2012-10033 json

Narcissus backend.php Image Configuration Command Injection

published 2025-08-05 15 mo ago modified 2026-07-28 3 mo ago also EUVD-2012-6574

cvss
9.3
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.0%
EPSS 2.0% chance of exploitation in 30 days, percentile 80%
public exploits
1
Metasploit

Summary

Narcissus is vulnerable to remote code execution via improper input handling in its image configuration workflow. Specifically, the backend.php script fails to sanitize the release parameter before passing it to the configure_image() function. This function invokes PHP’s passthru() with the unsanitized input, allowing attackers to inject arbitrary system commands. Exploitation occurs via a crafted POST request, resulting in command execution under the web server’s context.

Timeline

  1. First public exploit (Metasploit exploit/unix/webapp/narcissus_backend_exec)
  2. Published

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
total
Assessed
15 mo ago

Exploit prediction

1.98% chance of exploitation in the next 30 days, higher than 80% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • Metasploit exploit/unix/webapp/narcissus_backend_exec Narcissus Image Configuration Passthru Vulnerability metasploit exploit, excellent rank, 2012-11-14
  • raw.githubusercontent.com https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/narcissus_backend_exec.rb referenced PoC, tagged "exploit" by a source, unverified
  • exploit-db.com https://www.exploit-db.com/exploits/22709 referenced PoC, tagged "exploit" by a source, unverified
  • exploit-db.com https://www.exploit-db.com/exploits/22856 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA 4.0 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • Ångström Distribution Project Narcissus

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.