CVE Daily

CVE-2013-10066

An unauthenticated arbitrary file upload vulnerability exists in Kordil EDMS v2...

Critical CVSS 10.0

Overview

An unauthenticated arbitrary file upload vulnerability exists in Kordil EDMS v2.2.60rc3. The application exposes an upload endpoint (users_add.php) that allows attackers to upload files to the /userpictures/ directory without authentication. This flaw enables remote code execution by uploading a PHP payload and invoking it via a direct HTTP request.

CWE: CWE-434 Published: 2025-08-05T20:15:35.237
Risk analysis

This vulnerability is rated 🔴 CRITICAL.

  • CVSS: 10.0 (CRITICAL)
  • Detected tags: rce, unauth_access, upload (tag impact: VERY HIGH)

Recommended actions:

  • Patch/upgrade immediately (remote code execution).
  • Reduce exposure (WAF/segmentation), minimize attack surface.
  • Enforce authentication/authorization; reduce default endpoint exposure.
  • Restrict types/MIME, store outside web root, inspect content.

Recommended tools

Tags