CVE-2007-2431 Dynamic variable evaluation vulnerability in shared/config/tce_config.php in TCExam 4.0.011 and earlier allows remote attackers to conduct cross-site scripting (XSS) and possibly other attacks by modi...
MediumCVSS 6.8
EPSS 5.1%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Dynamic variable evaluation vulnerability in shared/config/tce_config.php in TCExam 4.0.011 and earlier allows remote attackers to conduct cross-site scripting (XSS) and possibly other attacks by modifying critical variables such as $_SERVER, as demonstrated by injecting web script via the _SERVER[SCRIPT_NAME] parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tecnick.com tcexam | <= 4.0.011 | No fix listed |
References
- 25008 third-party-advisory
- sourceforge.net patch
- 20070501 TCExam - 'XSS' is dynamic variable evaluation; vendor patch mailing-list
- 23704 vdb-entry
- tcexam-server-xss(33957) vdb-entry
- 3816 exploit