header-logo
Suggest Exploit
vendor:
Digi Online Examination System
by:
Halil Dalabasmaz
8,8
CVSS
HIGH
Unrestricted File Upload
434
CWE
Product Name: Digi Online Examination System
Affected Version From: v2.0
Affected Version To: v2.0
Patch Exists: Yes
Related CWE: CVE-2014-7169
CPE: a:digitalvidhya:digi_online_examination_system:2.0
Metasploit: https://www.rapid7.com/db/vulnerabilities/freebsd-vid-81e2b308-4a6c-11e4-b711-6805ca0b3d42/, https://www.rapid7.com/db/vulnerabilities/pulse-secure-pulse-connect-secure-cve-2014-6278/, https://www.rapid7.com/db/vulnerabilities/cisco-xe-cve-2014-6278/, https://www.rapid7.com/db/vulnerabilities/gentoo-linux-cve-2014-6278/, https://www.rapid7.com/db/vulnerabilities/oracle-solaris-cve-2014-6278/, https://www.rapid7.com/db/vulnerabilities/gnu-bash-cve-2014-6278/, https://www.rapid7.com/db/vulnerabilities/linuxrpm-ELSA-2014-3092/, https://www.rapid7.com/db/vulnerabilities/freebsd-vid-512d1301-49b9-11e4-ae2c-c80aa9043978/, https://www.rapid7.com/db/vulnerabilities/suse-cve-2014-6278/, https://www.rapid7.com/db/vulnerabilities/linuxrpm-ELSA-2014-3093/, https://www.rapid7.com/db/vulnerabilities/linuxrpm-ELSA-2014-3094/, https://www.rapid7.com/db/vulnerabilities/ubuntu-USN-2380-1/, https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2014-1354/, https://www.rapid7.com/db/vulnerabilities/alpine-linux-cve-2014-6277/, https://www.rapid7.com/db/vulnerabilities/alpine-linux-cve-2014-6278/, https://www.rapid7.com/db/vulnerabilities/oracle-solaris-cve-2014-6277/, https://www.rapid7.com/db/vulnerabilities/pulse-secure-pulse-connect-secure-cve-2014-6277/, https://www.rapid7.com/db/vulnerabilities/cisco-xe-cve-2014-6277/, https://www.rapid7.com/db/vulnerabilities/hpsim-cve-2014-6277/, https://www.rapid7.com/db/vulnerabilities/apple-osx-bash-cve-2014-6277/, https://www.rapid7.com/db/?q=CVE-2014-7169&type=&page=2, https://www.rapid7.com/db/?q=CVE-2014-7169&type=&page=3, https://www.rapid7.com/db/?q=CVE-2014-7169&type=&page=2
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: Windows, Linux, Mac
2014

Digi Online Examination System Unrestricted File Upload Vulnerability

You can upload your shell from 'Photo' section while register the system. And then chekc your shell from here; http://example.com/assets/uploads/images/shellname.php

Mitigation:

Filter the files aganist to attacks.
Source

Exploit-DB raw data:

# Exploit Title:  Digi Online Examination System Unrestricted File Upload Vulnerability
# Date: 12-10-2014
# Exploit Author: Halil Dalabasmaz
# Version: v2.0
# Software Link: http://codecanyon.net/item/digi-online-examination-system-does/8610180
# Software Test Link: http://s1.digitalvidhya.com/doesv2/

# Vulnerabilities Description:

===Unrestricted File Upload===
You can upload your shell from "Photo" section while register the system. And then chekc your shell from here; http://example.com/assets/uploads/images/shellname.php

=Solution=
Filter the files aganist to attacks.

Navigation

Suggest Exploit

Services By CQR