CVE-2010-2153
TCExam 10.1.006-10.1.007 - Unauthenticated Arbitrary File Upload and Remote Code Execution
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2010-2153. PoCs published by John Leitch.
AI-analyzed exploit summary This exploit demonstrates an arbitrary file upload vulnerability in TCExam 10.1.007, allowing attackers to upload a PHP shell via a malformed multipart/form-data POST request. The shell is then accessible at a predictable location, enabling remote code execution.
Description
Unrestricted file upload vulnerability in admin/code/tce_functions_tcecode_editor.php in TCExam 10.1.006 and 10.1.007 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in cache/.
Exploits (1)
This exploit demonstrates an arbitrary file upload vulnerability in TCExam 10.1.007, allowing attackers to upload a PHP shell via a malformed multipart/form-data POST request. The shell is then accessible at a predictable location, enabling remote code execution.