{"uuid": "5c5514f7-5565-4e40-a9e6-c7461a1b94a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2012-5357", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/ektron_xslt_exec.rb", "content": "{\"aliases\": [], \"arch\": \"\", \"author\": [\"Rich Lundeen\", \"juan vazquez \", \"Nicolas \\\"Nicob\\\" Gregoire\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a vulnerability in Ektron CMS 8.02 (before SP5). The\\n          vulnerability exists due to the insecure usage of XslCompiledTransform, using a\\n          XSLT controlled by the user. The module has been tested successfully on Ektron CMS\\n          8.02 over Windows 2003 SP2, which allows to execute arbitrary code with NETWORK\\n          SERVICE privileges.\", \"disclosure_date\": \"2012-10-16\", \"fullname\": \"exploit/windows/http/ektron_xslt_exec\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:58:31 +0000\", \"name\": \"Ektron 8.02 XSLT Transform Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/windows/http/ektron_xslt_exec.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"windows/http/ektron_xslt_exec\", \"references\": [\"CVE-2012-5357\", \"OSVDB-88107\", \"URL-http://webstersprodigy.net/2012/10/25/cve-2012-5357cve-1012-5358-cool-ektron-xslt-rce-bugs/\", \"URL-http://technet.microsoft.com/en-us/security/msvr/msvr12-016\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Windows 2003 SP2 / Ektron CMS400 8.02\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:51:46.401603Z"}