vendor:
TI Online Examination System v2
by:
Özkan Mustafa Akkus (AkkuS)
5.5
CVSS
MEDIUM
Arbitrary File Download
22
CWE
Product Name: TI Online Examination System v2
Affected Version From: 2
Affected Version To: 2
Patch Exists: NO
Related CWE:
CPE:
Platforms Tested: Kali Linux
2018
TI Online Examination System v2 – Arbitrary File Download
The 'Export' operation in the admin panel is vulnerable. The attacker can download and read all files known by the name via 'download.php'.
Mitigation:
The vendor should validate user input and restrict access to sensitive files.
