CVE-2007-2430

CVE-2007-2430 describes a critical vulnerability in TCExam 4.0.011 and earlier, where remote attackers can create arbitrary PHP files in the 'cache/' directory. This is achieved by manipulating the SessionUserLang cookie with file contents and directory traversal sequences, which is then processed by public/code/index.php. The vulnerability has a CVSS score of 7.8 (High), indicating a severe risk due to its network-based attack vector, low attack complexity, and high impact on integrity (arbitrary file creation). There is no authentication required for exploitation. While not listed on the KEV catalog, exploit code is publicly available on ExploitDB (EDB-3816), demonstrating a shell injection method. Despite this, there is minimal community discussion or media coverage surrounding this CVE.