CVEs-PoC/2013/CVE-2013-10066.md

CVE-2013-10066

Description

An unauthenticated arbitrary file upload vulnerability exists in Kordil EDMS v2.2.60rc3. The application exposes an upload endpoint (users_add.php) that allows attackers to upload files to the /userpictures/ directory without authentication. This flaw enables remote code execution by uploading a PHP payload and invoking it via a direct HTTP request.

POC

Reference

• https://www.exploit-db.com/exploits/24547
• https://www.vulncheck.com/advisories/kordil-edms-unauth-arbitrary-file-upload

Github

No PoCs found on GitHub currently.