CVE-2013-0803: PolarBear CMS unrestricted file upload in upload.php enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityUnauthenticated network-reachable arbitrary code execution with public exploit code and very high EPSS probability.

What it is

PolarBear CMS 2.5 exposes upload.php without restricting uploaded file types, allowing a malicious user to upload executable files. Because the uploaded file can be executed, this is a direct path to arbitrary code execution on the server. The flaw is rated critical (CVSS 3.1 9.8) and public exploit code exists.

Impact

An attacker can upload and execute arbitrary code, gaining full control of the web server under the application's privileges. This compromises confidentiality, integrity and availability of the host and any data it can reach.

Attack surface

Reachable over the network through upload.php with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any internet-exposed PolarBear CMS 2.5 instance is directly reachable.

Exploitation

Public exploit code is referenced on Exploit-DB and Packet Storm, and EPSS is 0.74977 (99.5th percentile), indicating high likelihood of exploitation. The CVE is not listed in CISA KEV, so no confirmed in-the-wild activity is documented in this record.

What to do

• Upgrade or remove PolarBear CMS 2.5; no fixed version is identified in this record, so treat the product as unsupported and migrate to a maintained CMS.
• If the application must stay online, restrict upload.php to authenticated users and enforce a server-side allowlist of file extensions and MIME types.
• Store uploaded files outside the web root and disable script execution in any upload directory.
• Place the application behind a WAF or reverse proxy that blocks executable file uploads and access to uploaded scripts.
• Monitor vendor and CVE sources for a patch, since none is listed here.

Detection

• Review web server logs for POST requests to upload.php followed by requests to newly created files in upload directories.
• Alert on files with executable extensions (.php, .phtml, .php5) appearing in upload or content directories.
• Monitor for unexpected child processes spawned by the web server user, which can indicate uploaded code execution.
• Use file integrity monitoring on web-accessible directories to catch newly written scripts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.