CVE-2020-28173

Simple College Website 1.0 allows a user to conduct remote code execution via /alumni/admin/ajax.php?action=save_settings when uploading a malicious file using the image upload functionality, which is stored in /alumni/admin/assets/uploads/.

• CWE-434

• https://dl.packetstormsecurity.net/2010-exploits/simplecollegewebsite10-sqlexec.txtExploit, Third Party Advisory
• https://github.com/yunaranyancat/poc-dump/blob/main/simplecollegewebsite/sqli_rce.pyExploit, Third Party Advisory
• https://www.sourcecodester.com/php/14548/simple-college-website-using-htmlphpmysqli-source-code.htmlThird Party Advisory
• https://www.sourcecodester.com/sites/default/files/download/oretnom23/simple-college-website.zipThird Party Advisory
• https://dl.packetstormsecurity.net/2010-exploits/simplecollegewebsite10-sqlexec.txtExploit, Third Party Advisory
• https://github.com/yunaranyancat/poc-dump/blob/main/simplecollegewebsite/sqli_rce.pyExploit, Third Party Advisory
• https://www.sourcecodester.com/php/14548/simple-college-website-using-htmlphpmysqli-source-code.htmlThird Party Advisory
• https://www.sourcecodester.com/sites/default/files/download/oretnom23/simple-college-website.zipThird Party Advisory

Published

Mar 31, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-28163libdwarf before 20201201 allows a dwarf_print_lines.c NULL p…6.5
• CVE-2020-28165The EasyCorp ZenTao PMS 12.4.2 application suffers from an a…9.8
• CVE-2020-28168Axios NPM package 0.21.0 contains a Server-Side Request Forg…5.9
• CVE-2020-28169The td-agent-builder plugin before 2020-12-18 for Fluentd al…7
• CVE-2020-2817Vulnerability in the Oracle Scripting product of Oracle E-Bu…8.2
• CVE-2020-28172A SQL injection vulnerability in Simple College Website 1.0 …9.8
• CVE-2020-28175There is a local privilege escalation vulnerability in Alfre…7.8
• CVE-2020-2818Vulnerability in the Oracle Universal Work Queue product of …8.2
• CVE-2020-28183SQL injection vulnerability in SourceCodester Water Billing …9.8
• CVE-2020-28184Cross-site scripting (XSS) vulnerability in TerraMaster TOS …5.4
• CVE-2020-28185User Enumeration vulnerability in TerraMaster TOS <= 4.2.06 …5.3
• CVE-2020-28186Email Injection in TerraMaster TOS <= 4.2.06 allows remote u…7.3