CVE-2013-10066

published 2025-08-05

CVE-2013-10066: An unauthenticated arbitrary file upload vulnerability exists in Kordil EDMS v2.2.60rc3. The application exposes an upload endpoint (users_add.php) that allows…

Priority P2 73 critical 10 CVSS 4.0

AV N AC L AT N PR N UI N VC H VI H VA H SC H SI H SA H E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

EXPLOIT

An unauthenticated arbitrary file upload vulnerability exists in Kordil EDMS v2.2.60rc3. The application exposes an upload endpoint (users_add.php) that allows attackers to upload files to the /userpictures/ directory without authentication. This flaw enables remote code execution by uploading a PHP payload and invoking it via a direct HTTP request.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
kordil	edms	—	—

Detection & IOCs extracted from sources · hover to see the quote

path /userpictures/↗

path /kordil_edms/userpictures/↗

filename users_add.php↗

• → Monitor for unauthenticated POST requests to users_add.php, particularly those containing file upload data (multipart/form-data), as this endpoint requires no authentication and is the attack vector for arbitrary file upload. ↗
• → Alert on HTTP GET/POST requests to /kordil_edms/userpictures/ or /userpictures/ following a POST to users_add.php — this pattern indicates a PHP webshell upload followed by remote code execution invocation. ↗
• → Detect PHP files written to the /kordil_edms/userpictures/ directory on disk, as legitimate user picture uploads should not be executable PHP scripts. ↗

• · The Metasploit module targets Kordil EDMS v2.2.60rc3 specifically; other versions may have a different upload path or may not be vulnerable. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434