RCE in Digitalvidhya Digi Online Examination System

CVE-2014-8997

Unrestricted file upload vulnerability in the Photo functionality in DigitalVidhya Digi Online Examination System 2.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in assets/uploads/images/.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.091 (94.8th percentile) — read the EPSS interpretation.

Affected products

Digitalvidhya Digi_online_examination_system — versions 2.0
N/a — versions n/a

Weakness classification (CWE)

CWE-94 — Code Injection

References

cve@mitre.org (Exploit, exploit, x_refsource_EXPLOIT-DB)
cve@mitre.org (x_refsource_MISC)
cve@mitre.org (vdb-entry, x_refsource_XF)