CVE-2013-10066 in EDMS
Summary
by MITRE • 08/05/2025
An unauthenticated arbitrary file upload vulnerability exists in Kordil EDMS v2.2.60rc3. The application exposes an upload endpoint (users_add.php) that allows attackers to upload files to the /userpictures/ directory without authentication. This flaw enables remote code execution by uploading a PHP payload and invoking it via a direct HTTP request.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/06/2025
The vulnerability identified as CVE-2013-10066 represents a critical security flaw in Kordil EDMS version 2.2.60rc3, specifically targeting the application's file upload functionality. This issue manifests as an authentication bypass that allows any remote attacker to upload arbitrary files to the system without requiring valid credentials or access privileges. The vulnerability resides within the users_add.php endpoint which serves as the primary interface for user-related operations, making it a high-value target for exploitation. The exposed upload functionality directly maps to the /userpictures/ directory, creating an attack surface where malicious actors can place files with potentially dangerous content.
The technical implementation of this vulnerability stems from inadequate input validation and authentication checks within the file upload mechanism. The application fails to properly verify the identity of users attempting to access the upload endpoint, while simultaneously not implementing proper file type restrictions or content validation. This combination of weaknesses creates a path for attackers to bypass authentication requirements entirely, allowing them to upload files of any type to the server. The vulnerability specifically enables remote code execution because PHP files can be uploaded and subsequently executed through direct HTTP requests to the uploaded payload, making the exploitation process straightforward and highly effective.
From an operational perspective, this vulnerability presents a severe risk to organizations using Kordil EDMS v2.2.60rc3 as it allows attackers to gain persistent access to the underlying system. The ability to upload PHP payloads means that adversaries can execute arbitrary commands on the server, potentially leading to complete system compromise, data exfiltration, or the establishment of backdoors for continued access. The unauthenticated nature of the vulnerability eliminates the need for credentials, making it particularly dangerous as it can be exploited by anyone who can reach the application. The impact extends beyond immediate code execution to include potential privilege escalation, lateral movement within network environments, and the ability to use the compromised system as a staging ground for further attacks. This vulnerability directly aligns with CWE-434, which describes the weakness of unrestricted file upload, and represents a classic example of how insufficient access control can lead to critical system compromise.
Organizations affected by this vulnerability should implement immediate mitigations including restricting access to the upload endpoint through network segmentation, implementing proper authentication mechanisms, and enforcing strict file type validation. The recommended approach involves configuring the web server to prevent execution of uploaded files in the /userpictures/ directory, implementing proper input sanitization, and ensuring that all file uploads are properly authenticated and validated. Security measures should include disabling PHP execution in upload directories, implementing file extension and content validation, and establishing proper access controls that require valid user authentication before allowing file upload operations. The vulnerability also highlights the importance of regular security assessments and the need for implementing defense-in-depth strategies that include network monitoring, intrusion detection systems, and proper access control policies. Organizations should also consider implementing the principle of least privilege and regularly updating their software to ensure that known vulnerabilities are patched before they can be exploited by malicious actors. This vulnerability demonstrates the critical importance of proper authentication and authorization controls in preventing unauthorized access to system functions and serves as a reminder of the potential consequences when these controls are insufficient or absent from web applications.