CVE-2013-10066

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/kordil_edms_upload_exec.rb", "name": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/kordil_edms_upload_exec.rb", "tags": [], "refsource": ""}, {"url": "https://sourceforge.net/projects/kordiledms/", "name": "https://sourceforge.net/projects/kordiledms/", "tags": [], "refsource": ""}, {"url": "https://www.exploit-db.com/exploits/24547", "name": "https://www.exploit-db.com/exploits/24547", "tags": [], "refsource": ""}, {"url": "https://www.juniper.net/us/en/threatlabs/ips-signatures/detail.APP:MSF-KORDIL-EDMS-AFU.html", "name": "https://www.juniper.net/us/en/threatlabs/ips-signatures/detail.APP:MSF-KORDIL-EDMS-AFU.html", "tags": [], "refsource": ""}, {"url": "https://www.vulncheck.com/advisories/kordil-edms-unauth-arbitrary-file-upload", "name": "https://www.vulncheck.com/advisories/kordil-edms-unauth-arbitrary-file-upload", "tags": [], "refsource": ""}, {"url": "https://www.exploit-db.com/exploits/24547", "name": "https://www.exploit-db.com/exploits/24547", "tags": [], "refsource": ""}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "An unauthenticated arbitrary file upload vulnerability exists in\u00a0Kordil EDMS v2.2.60rc3. The application exposes an upload endpoint\u00a0(users_add.php) that allows attackers to upload files to the /userpictures/ directory without authentication. This flaw enables remote code execution by uploading a PHP payload and invoking it via a direct HTTP request."}]}, "problemtype": {"problemtype_data": [{"description": []}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2013-10066", "ASSIGNER": "disclosure@vulncheck.com"}}, "impact": {}, "publishedDate": "2025-08-05T20:15Z", "configurations": {"nodes": [], "CVE_data_version": "4.0"}, "lastModifiedDate": "2025-08-07T14:15Z"}