Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2010-2153: TCExam lets attackers run code through uploaded files

CVE-2010-2153 · published 16 years ago

Summary

The TCExam testing system (versions 10.1.006 and 10.1.007) lets anyone upload a file with an executable extension to a specific admin folder. If a malicious file is uploaded, it can be accessed and run on the server, giving an attacker control. Update to a patched version or restrict file uploads and remove the vulnerable script immediately.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
tecnick	tcexam	10.1.006 10.1.007 `cpe:2.3:a:tecnick:tcexam:10.1.006:::::::*`

Original advisory text

Unrestricted file upload vulnerability in admin/code/tce_functions_tcecode_editor.php in TCExam 10.1.006 and 10.1.007 allows remote attackers to execute arbitrary code by uploading a file with an e...

References

http://cross-site-scripting.blogspot.com/2010/06/tcexam-101006-arbitrary-upload.... Exploit
http://osvdb.org/65052
http://secunia.com/advisories/40011 Vendor Advisory
http://www.packetstormsecurity.org/1006-exploits/tcexam-shell.txt Exploit
http://www.securityfocus.com/bid/40511 Exploit
http://www.vupen.com/english/advisories/2010/1329 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.8 Medium

Exploitation

7% chance of attack within 30 days

Timeline

Published3 Jun 2010

Updated15 Oct 2026

First seen29 Sep 2026

Sources

CVE-2010-2153 · NVD

Track software like this

Free during beta